[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcjbSqJzXQlMBY2U4AThN-zQjjqAbthm_IgEufpd7K0M":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":122},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"6125e316-89a4-419c-9203-9d7df19851ad","IQVIA fined $7.8 million for failing to properly anonymize health data","iqvia-fined-7-8-million-for-failing-to-properly-anonymize-health-data-c4a34e","Italy's Data Protection Authority (GPDP) has fined IQVIA €7 million ($7.8M) over poor data-processing practices that the agency says could have put roughly one million patients at risk of data exposure and de-anonymization. [...]","Italy's Data Protection Authority (GPDP) has fined IQVIA €7 million ($7.8M) for inadequate anonymization of health data, potentially exposing one million patients. The GPDP found that IQVIA's database, while using unique codes, allowed for patient re-identification due to detailed personal information. The company also processed data without a legal basis, failed to inform patients, and had no data retention periods, with records dating back to 2001.","IQVIA fined $7.8M by Italy's GPDP for improper health data anonymization.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fiqvia-fined-78-million-for-failing-to-properly-anonymize-health-data\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F09\u002Fhealthcare.jpg","2026-10-05T17:19:53+00:00","2026-10-05T18:00:25.578336+00:00",8,[17,20],{"name":18,"type":19},"IQVIA","vendor",{"name":21,"type":22},"GDPR","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":23,"icon":25,"name":26,"slug":27},null,"Privacy Fines","privacy-fines",[29,34,38,43],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":21,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":39},{"id":40,"icon":25,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":48,"vendors":121},[49,78,104],{"slug":50,"name":51,"problem":52,"products":53},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":79,"name":80,"problem":81,"products":82},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[83,91,96],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":92,"product_name":93,"url":94,"description":95},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"slug":105,"name":106,"problem":107,"products":108},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[109,115],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":110,"product_name":111,"url":113,"description":114},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":123,"title":124,"body":125,"framework_refs":126,"framework_notes":137},"iqvia-fined-78m-for-inadequate-health-data-anonymization","IQVIA Fined $7.8M for Inadequate Health Data Anonymization","IQVIA's anonymization approach was fundamentally flawed — using unique codes alone is insufficient if the accompanying dataset contains enough detailed attributes to re-identify individuals through linkage or inference attacks. The company compounded the violation by processing sensitive health data without a legal basis, failing to notify patients, and retaining records with no defined expiry policy, some dating back over two decades. This case highlights that pseudonymization is not the same as true anonymization under GDPR, and organizations must rigorously validate that de-identification techniques withstand re-identification risk assessments. Regulatory penalties at this scale serve as a clear warning that technical controls must be accompanied by proper governance, transparency, and lawful processing grounds.",[127,128,129,130,131,132,133,134,135,136],"GDPR Article 5 (Principles of data processing, including storage limitation and data minimisation)","GDPR Article 6 (Lawfulness of processing)","GDPR Article 13\u002F14 (Transparency and information obligations)","GDPR Article 25 (Data protection by design and by default)","GDPR Article 35 (Data Protection Impact Assessment)","NIST SP 800-188 (De-Identification of Personal Information)","NIST Privacy Framework PR.DS (Data Security)","CIS Control 3 (Data Protection)","ISO\u002FIEC 29101 (Privacy Architecture Framework)","ISO\u002FIEC 27701 (Privacy Information Management System)",{}]