[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fY7YCVsNTkg5J9V9WGM4Tup0BBzTotXDl23G-3vb3fFw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":40},"c7ceeeb1-3dbf-4264-83fc-5b8eae139dfb","cnil-fines-iqvia-5m-for-inadequate-health-data-pseudonymisation","4fb6a39c-9511-4778-addf-3c0e7233b5de","CNIL Fines IQVIA €5M for Inadequate Health Data Pseudonymisation","IQVIA Operations France failed to implement sufficient pseudonymisation techniques for health data repositories containing 20 million patient records, allowing potential re-identification of individuals. The company also violated transparency requirements by not properly informing patients about data processing activities. This case demonstrates that basic pseudonymisation is insufficient for sensitive health data and that organizations must implement privacy-by-design principles from the outset. The €5 million fine underscores regulators' expectations for robust data protection measures, especially when processing large-scale health datasets.","**Immediate actions:**\n- Conduct privacy impact assessments for all health data processing activities\n- Review and strengthen existing pseudonymisation techniques with additional safeguards\n- Update patient consent forms and privacy notices to ensure GDPR transparency compliance\n\n**Long-term improvements:**\n- Implement privacy-by-design principles in all data processing systems from development\n- Establish regular audits of pseudonymisation effectiveness with external validation\n- Deploy advanced anonymisation techniques like differential privacy for sensitive datasets\n\n**Governance measures:**\n- Create cross-functional privacy committees including legal, technical, and medical experts\n- Develop comprehensive data governance frameworks with clear accountability structures\n- Establish ongoing GDPR compliance monitoring with automated privacy controls",[12,13,14,15,16,17],"GDPR Article 14","GDPR Article 25","GDPR Article 35","NIST Privacy Framework","ISO 27001","CIS Control 3",{},"published","2026-05-29T12:20:23.618289+00:00","2026-05-29T12:20:23.514+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNIL_(France)_-_SAN-2026-008&diff=51768&oldid=0","cnil-france-san-2026-008-9558e8","CNIL (France) - SAN-2026-008",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":34,"name":35,"slug":36,"description":37,"color":38},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[41,45,49],{"slug":42,"name":43,"problem":44},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":46,"name":47,"problem":48},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":50,"name":51,"problem":52},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]