Italy's Data Protection Authority issues major privacy fines

The Italian Data Protection Authority (Garante) has issued significant sanctions against entities for failing to comply with GDPR principles, specifically regarding the principle of accountability and the handling of sensitive data.

IQVIA Solutions Italy S. r. l. was fined 7 million euros for processing the health data of approximately one million patients collected from 800 family doctors. The Authority determined that the data used for clinical research and pharmaceutical studies was not truly anonymous, as the detailed information—including birth years, diagnoses, and location data—allowed for the potential re-identification of individuals. The investigation also found that the company lacked an adequate legal basis for processing, failed to inform patients properly, and did not implement sufficient security measures or data retention limits.

In a separate context, the Authority’s enforcement actions highlight that mere documentation is insufficient for compliance. A 300,000 euro fine imposed on an energy provider serves as a precedent for the principle of accountability, emphasizing that organizations must demonstrate that privacy policies are actively applied in daily operations rather than just existing on paper. This standard applies broadly to all professionals handling personal data, including condominium administrators.