The Italian Data Protection Authority imposed an administrative fine of EUR 7,000,000 on IQVIA Solutions Italy S.r.l. for processing health data without a legal basis, inadequate information to patients, and missing DPIA and retention measures. The decision, dated 23 September 2026, requires IQVIA to achieve GDPR compliance within 120 days or have anonymisation carried out by the general practitioners.
Why it matters: The fine highlights enforcement of GDPR obligations for health data controllers and underscores the need for proper legal bases, transparency, and impact assessments.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
