Enforcement action · Commission Nationale de l'Informatique et des Libertés (CNIL)

Sanction à l’encontre de la société IQVIA OPERATIONS FRANCE

Sanction à l’encontre de la société IQVIA OPERATIONS FRANCE is an AI-related enforcement action involving Commission Nationale de l'Informatique et des Libertés (CNIL). Penalty: monetary_fine of $5000000 euros. The French CNIL fined IQVIA OPERATIONS FRANCE €5 million and issued injunctions for failing to comply with data protection authorizations regarding health data warehouses, citing insufficient transparency, rights exercise, and security measures.

Action details

Agency
Commission Nationale de l'Informatique et des Libertés (CNIL)
Jurisdiction
FR
Enforcement type
fine
Document type
enforcement action
Penalty
$5000000 euros monetary_fine
Effective
2026-05-26
Topic
ai privacy

Summary

France's CNIL (Commission Nationale de l'Informatique et des Libertés) has fined IQVIA OPERATIONS FRANCE €5 million for significant breaches of data protection rules concerning its health data warehouses. The sanction addresses failures to respect authorization conditions, specifically regarding informing individuals, enabling their rights, and ensuring data security, affecting millions of sensitive health data records. The CNIL also ordered corrective actions within six months, with a daily penalty for non-compliance. This ruling underscores that pseudonymized health data, where re-identification is possible, remains personal data subject to stringent protection.

Primary source

https://www.cnil.fr/fr/donnees-sante-sanction-5-millions-iqvia →

Related Commission Nationale de l'Informatique et des Libertés (CNIL) actions

Frequently asked questions

What is Sanction à l’encontre de la société IQVIA OPERATIONS FRANCE?
France's CNIL (Commission Nationale de l'Informatique et des Libertés) has fined IQVIA OPERATIONS FRANCE €5 million for significant breaches of data protection rules concerning its health data warehouses. The sanction addresses failures to respect authorization conditions, specifically regarding informing individuals, enabling their rights, and ensuring data security, affecting millions of sensitive health data records. The CNIL also ordered corrective actions within six months, with a daily penalty for non-compliance. This ruling underscores that pseudonymized health data, where re-identification is possible, remains personal data subject to stringent protection. Primary source →
Which agency brought the action?
Commission Nationale de l'Informatique et des Libertés (CNIL) brought this enforcement action in FR. Primary source →
What was the penalty?
The disclosed penalty is a monetary_fine amount of $5000000 euros. Primary source →
When did the action take effect?
The action was effective 2026-05-26. Primary source →
Where can I find the primary source?
The primary source for Sanction à l’encontre de la société IQVIA OPERATIONS FRANCE is at https://www.cnil.fr/fr/donnees-sante-sanction-5-millions-iqvia. AIGI does not paraphrase secondary commentary — every claim on this page links back to that primary source. Primary source →

Related

Stay informed

Get every Commission Nationale de l'Informatique et des Libertés (CNIL) AI enforcement update.

Start 14-day trial →