Cybersecurity Policy Report, Medical Data Company Faces Privacy Fine in France, (May 29, 2026)

By Tony Foley

Clinical research and health data provider IQVIA Operation France has been fined 5 million euros ($5.8 million) by the French data protection authority, the Commission nationale de l’informatique et des libertés, for failing to comply with safeguards aimed at limiting risks to individuals in the context of managing health data warehouses.

CNIL’s press release announcing the sanctions noted that IQVIA provided consulting and studies on its own behalf and for pharmaceutical laboratories focused on certain diseases or administered treatments. The company relied on two health data warehouses that CNIL had authorized it to create, the LRX warehouse powered by data collected from 14,000 pharmacies, and the EMR warehouse, powered by data collected from several thousand doctors. In its authorization, CNIL mandated the implementation of a number of safeguards to limit risks to individuals in light of the sensitivity of health information. But CNIL received several complaints from individuals and organizations concerning the lack of transparency by IQVIA in the data processing carried out regarding patients.

After conducting audits of the company and its partner pharmacies, CNIL found that IQVIA had not complied with the terms of the authorizations issued by CNIL, particularly with respect to notifying individuals, exercising their rights, and data security. IQVIA argued that the data in the warehouses at issue was anonymous and that it therefore was not subject to data protection rules under the European Union’s General Data Protection Regulation (GDPR) and the French Data Protection Act, but CNIL found that the data was pseudonymized, rather than anonymized, giving rise to a heightened risk of reidentification using reasonable means.

CNIL’s specific findings were as follows:

1. IVQIA failed to comply with the CNIL’s authorization safeguards in violation of article 66 of the Data Protection Act; and

2. The company’s partner pharmacies failed to notify individuals regarding the LRX warehouse, particularly regarding the transmission of their data to IVQIA, in violation of GDPR articles 14 and 25.

In addition to the fine, CNIL’s decision issues an injunction requiring IVQIA to bring its processing operations in line with the data protection laws cited above within six months and provides for a penalty of up to 10,000 euros per day of delay in compliance after that six-month period.

News: InternationalLegislation LitigationEnforcement DataPrivacy DataSecurity GDPR