Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of health data
The Italian DPA fined IQVIA Solutions Italy S.r.l. EUR 7,000,000 for processing health data without a legal basis, inadequate information, no DPIA, and insufficient security. IQVIA must comply within 120 days or have GPs anonymise data independently.
- Framework
- GDPR
- Who it concerns
- IQVIA Solutions Italy S.r.l.
What changed?
Each point with the sentence from the source that says it.
The Italian DPA found that IQVIA processed health data without an appropriate legal basis and without providing adequate information to patients.
The Italian DPA found that IQVIA, as controller, processed health data without an appropriate legal basis and without providing adequate information to patients.
IQVIA failed to establish appropriate retention periods, carry out a data protection impact assessment and implement adequate security measures.
It also failed to establish appropriate retention periods, carry out a data protection impact assessment and implement adequate security measures.
If IQVIA intends to continue the processing, it must bring it into compliance with the GDPR within 120 days, including by identifying an appropriate legal basis, complying with its information obligations towards patients, carrying out a data protection impact assessment and appointing the general practitioners as processors.
If IQVIA intends to continue the processing, it must bring it into compliance with the GDPR within 120 days, including by identifying an appropriate legal basis, complying with its information obligations towards patients, carrying out a data protection impact assessment and appointing the general practitioners as processors.
Alternatively, the anonymisation process must be carried out independently by the general practitioners in accordance with the safeguards specified by the Italian Authority.
Alternatively, the anonymisation process must be carried out independently by the general practitioners in accordance with the safeguards specified by the Italian Authority.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Data Protection Policy
Review the Data Protection Policy to ensure it requires a legal basis for processing health data and provides adequate information to data subjects.
- Data Protection Impact Assessment
Review the Data Protection Impact Assessment procedure to ensure DPIAs are carried out for high-risk processing such as large-scale health data.
- Data Retention and Erasure Policy
Review the Data Retention and Erasure Policy to establish appropriate retention periods for health data.
- Records of Processing Activities
Review the Records of Processing Activities to ensure processors such as general practitioners are properly appointed and documented.