[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGfD0b8VF1P4QifEyhCVwI1RkSBWiPih1XCkWE8ejBmM":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":117},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"6c725494-155c-4735-8b8e-2f73d75fcf35","Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data","italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-93d883","Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data ikerinar Fri, 09\u002F10\u002F2026 - 10:02","The Italian Data Protection Authority (DPA) has fined IQVIA Solutions Italy S.r.l. EUR 7 million for unlawfully processing the health data of approximately one million patients. The DPA found that the data, used for health analytics and clinical research, was not adequately anonymized and IQVIA failed to establish a proper legal basis, provide sufficient information to patients, and implement adequate security measures. IQVIA has 120 days to comply with GDPR requirements or anonymize the data.","Italian DPA fines IQVIA EUR 7M for unlawful processing of patient health data.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fitalian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en",null,"2026-10-09T08:02:05+00:00","2026-10-09T10:00:18.649533+00:00",8,[17,20],{"name":18,"type":19},"IQVIA","vendor",{"name":21,"type":22},"database","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":23,"icon":12,"name":25,"slug":26},"Privacy Fines","privacy-fines",[28,33,38],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":34},{"id":35,"icon":12,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":23,"icon":12,"name":25,"slug":26},[],[18,21],{"controls":43,"vendors":116},[44,73,99],{"slug":45,"name":46,"problem":47,"products":48},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":74,"name":75,"problem":76,"products":77},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":95,"product_name":96,"url":97,"description":98},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"slug":100,"name":101,"problem":102,"products":103},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[104,110],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":105,"product_name":106,"url":108,"description":109},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":112,"url":114,"description":115},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":118,"title":119,"body":120,"framework_refs":121,"framework_notes":135},"iqvia-fined-7m-for-inadequate-anonymization-and-unlawful-health-data-processing","IQVIA Fined €7M for Inadequate Anonymization and Unlawful Health Data Processing","IQVIA unlawfully processed the sensitive health data of approximately one million patients by failing to properly anonymize it and lacking a valid legal basis under GDPR. The case highlights that pseudonymization or partial de-identification does not satisfy GDPR anonymization requirements, meaning the data remained regulated personal data throughout its use in analytics and research. Organizations handling health data must establish a clear lawful basis, provide transparent patient notices, and implement robust technical safeguards before any processing begins. This incident demonstrates that regulatory fines can be severe when multiple GDPR obligations—legal basis, transparency, and security—are violated simultaneously.",[122,123,124,125,126,127,128,129,130,131,132,133,134],"GDPR Article 5 – Principles relating to processing of personal data","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 13\u002F14 – Transparency and information obligations","GDPR Article 25 – Data protection by design and by default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 32 – Security of processing","NIST Privacy Framework PR.DP-1 – Data are processed with sufficient protections","NIST SP 800-188 – De-Identification of Personal Information","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management","EDPB Guidelines 05\u002F2020 on Consent","EDPB Opinion 05\u002F2014 on Anonymisation Techniques",{}]