CNIL (France) - SAN-2026-008
CNIL fines IQVIA €5M for GDPR breaches in health data pseudonymisation and patient notification.
France's CNIL issued a €5 million fine to IQVIA Operations France for violations of GDPR Articles 14 and 25, finding that patients could be re-identified despite pseudonymisation of pharmacy and medical records data, and were not properly informed of data processing. The breaches involved two health data repositories (LRX pharmacy data and EMR physician consultation data) containing information on approximately 20 million patients, where pseudonymisation and consent mechanisms were deemed inadequate.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IQVIA?
Get an email when a new story names IQVIA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonIQVIA Operations France failed to implement sufficient pseudonymisation techniques for health data repositories containing 20 million patient records, allowing potential re-identification of individuals. The company also violated transparency requirements by not properly informing patients about data processing activities. This case demonstrates that basic pseudonymisation is insufficient for sensitive health data and that organizations must implement privacy-by-design principles from the outset. The €5 million fine underscores regulators' expectations for robust data protection measures, especially when processing large-scale health datasets.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.