Italian Data Protection Authority (Garante) · 23 September 2026
IQVIA Solutions Italy S.r.l.
Insufficient legal basis for data processing
- Regulator
- Italian Data Protection Authority (Garante)
- Decided
- 23 September 2026
- Country
Italy- Sector
- Health Care
- Regulator’s reference
- Not recorded
- Fino case number
- 2026/IT/158
What happened
The DPA issued a €7 m fine on a controller after a routine inspection of their services uncovered a data breach which resulted in the disclosure of 3,780 patients’ data. In particular, the DPA held that the data was not sufficiently anonymized not to be personal data and were processed without a legal basis.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 5Principles relating to processing of personal data5(2)Read →
- Art. 9Processing of special categories of personal dataRead →
- Art. 13Information to be provided where personal data are collected from the data subjectRead →
- Art. 25Data protection by design and by defaultRead →
- Art. 28ProcessorRead →
- Art. 35Data protection impact assessmentRead →
- Accountability
- DPIA
- Data principles
- Processor obligations
- Special categories
- Transparency
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Thank you for telling me: write to hello@finoprivacy.com and quote 2026/IT/158.