IQVIA fined €5M for health-data warehouses that tracked patients without telling them

IQVIA Operations France, the French arm of the health-analytics group IQVIA, ran two health data warehouses the CNIL had authorized: LRX, fed by dispensing data from about 14,000 pharmacies since 2018, and EMR, fed by records from roughly 2,000-3,000 doctors since 2021. Each patient gets a unique identifier that links purchases, diagnoses, symptoms, weight, vaccines and sick leave into one longitudinal record — IQVIA's own brochure advertised '20 million anonymized patients followed over time' — and the data feeds studies sold to pharmaceutical laboratories.

In 2021 the TV programme Cash Investigation showed pharmacy customers' data flowing to IQVIA without their knowledge; France Assos Santé complained to the CNIL, which inspected the company and partner pharmacies. Findings: nobody regularly analyzed connection logs in either warehouse, so abnormal access would go unnoticed; EMR had no multi-factor authentication, an inaccurate patient notice, and no effective way to object. Of four Paris pharmacies checked, none told customers their data went to IQVIA — a notice duty IQVIA had delegated to pharmacists but still owned as controller.

Worse, modules IQVIA plugged into pharmacy software could extract patient data even when the pharmacist opted out — a violation of GDPR Article 25, data protection by design — and some studies ran on LRX outside any legal framework. During the procedure IQVIA argued the data was anonymous and the GDPR inapplicable, citing the CJEU's 2025 SRB ruling. The CNIL rejected this: a unique per-patient identifier, the depth of the data, and re-identification by combining public sources make the data pseudonymous, not anonymous — and until then IQVIA had never disputed handling personal data.

On 26 May 2026 the CNIL's restricted committee fined IQVIA Operations France €5 million, citing the sensitivity of health data, the tens of millions of people affected, and the company's market position.

€5M fine, with six-month injunctions enforceable at €10,000 per day of delay

Patient notification was outsourced to pharmacists with no mechanism to verify it happened — years of data flows and not a single pharmacy delivered the notice.

Security stopped at the front door: connection logs were never analyzed and EMR had no MFA, so misuse inside the warehouses would have been invisible.

The opt-out existed on paper but the software design overrode it, extracting data even after refusal — compliance was never built into the pipeline.

Authorization conditions were treated as paperwork from 2018 and 2021 rather than standing obligations that the regulator would one day audit against.

Pseudonymized data with a per-person ID is not anonymous; the GDPR still applies. An authorization is a floor, not a license — including the notices and opt-outs you delegate to partners.

The fine was made public on 28 May 2026 as deliberation SAN-2026-008. IQVIA fixed the security gaps during the proceedings, which the committee acknowledged, but injunctions remain: correct the EMR patient notice, make objection effective, ensure pharmacies actually inform customers, stop non-compliant LRX studies, and stop extraction despite refusal — enforceable at €10,000 per day after six months. IQVIA took note and reserved the right to appeal to the Conseil d'État. The ruling lands mid-fight over what 'anonymous' means after the CJEU's SRB decision.