[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIhHfZEPPKCJ34pHYZaYwHbal551TDZcoZel0IqV-sMA":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":120},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"4fb6a39c-9511-4778-addf-3c0e7233b5de","CNIL (France) - SAN-2026-008","cnil-france-san-2026-008-9558e8","Created page with \"{{DPAdecisionBOX |Jurisdiction=France |DPA-BG-Color= |DPAlogo=LogoFR.png |DPA_Abbrevation=CNIL |DPA_With_Country=CNIL (France) |Case_Number_Name=SAN-2026-008 |ECLI= |Original_Source_Name_1=CNIL |Original_Source_Link_1=https:\u002F\u002Fwww.legifrance.gouv.fr\u002Fcnil\u002Fid\u002FCNILTEXT000054136834?fonds=CNIL&page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT |Original_Source_Language_1=French |Origina...\" Show changes","France's CNIL issued a €5 million fine to IQVIA Operations France for violations of GDPR Articles 14 and 25, finding that patients could be re-identified despite pseudonymisation of pharmacy and medical records data, and were not properly informed of data processing. The breaches involved two health data repositories (LRX pharmacy data and EMR physician consultation data) containing information on approximately 20 million patients, where pseudonymisation and consent mechanisms were deemed inadequate.","CNIL fines IQVIA €5M for GDPR breaches in health data pseudonymisation and patient notification.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNIL_(France)_-_SAN-2026-008&diff=51768&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fthumb\u002F0\u002F0f\u002FLogoFR.png\u002F1200px-LogoFR.png","2026-05-29T11:51:59+00:00","2026-05-29T12:00:16.08147+00:00",7,[17,20],{"name":18,"type":19},"IQVIA","vendor",{"name":21,"type":19},"CNIL","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":22,"icon":24,"name":25,"slug":26},null,"GDPR","gdpr",[28,33,38],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":39},{"id":40,"icon":24,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":46,"vendors":119},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":77,"name":78,"problem":79,"products":80},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":98,"product_name":99,"url":100,"description":101},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"slug":103,"name":104,"problem":105,"products":106},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[107,113],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":108,"product_name":109,"url":111,"description":112},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":114,"product_name":115,"url":117,"description":118},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":121,"title":122,"body":123,"framework_refs":124,"framework_notes":131},"cnil-fines-iqvia-5m-for-inadequate-health-data-pseudonymisation","CNIL Fines IQVIA €5M for Inadequate Health Data Pseudonymisation","IQVIA Operations France failed to implement sufficient pseudonymisation techniques for health data repositories containing 20 million patient records, allowing potential re-identification of individuals. The company also violated transparency requirements by not properly informing patients about data processing activities. This case demonstrates that basic pseudonymisation is insufficient for sensitive health data and that organizations must implement privacy-by-design principles from the outset. The €5 million fine underscores regulators' expectations for robust data protection measures, especially when processing large-scale health datasets.",[125,126,127,128,129,130],"GDPR Article 14","GDPR Article 25","GDPR Article 35","NIST Privacy Framework","ISO 27001","CIS Control 3",{}]