Italy fines IQVIA €7 million over the failure to anonymize patient records

Italy’s data protection authority found that IQVIA Solutions Italy’s “anonymous” patient database could in fact be reidentified and fined the company €7 million. The authority said that fixed 22-digit patient identifiers retained uniqueness and therefore could not constitute anonymization. IQVIA was also found to have processed health data without a legal basis, failed to inform patients, lacked a deletion policy, and failed to conduct an impact assessment, among other issues. It was ordered to remedy the violations within 120 days.