Italy's data protection authority, the Garante, has fined IQVIA €7,000,000 for unlawfully processing patients' health data, the European Data Protection Board reported.
IQVIA is a health data and analytics company that works extensively with pharmaceutical and healthcare clients, meaning the decision is likely to be closely watched by organisations handling similarly sensitive datasets across the sector.
The EDPB summary does not detail the specific processing activities found unlawful, the legal basis the Garante considered inadequate, or whether the decision includes corrective measures beyond the financial penalty.
Health data is classified as a special category of personal data under the GDPR, and its processing is subject to stricter conditions than ordinary personal data, including heightened requirements around consent, necessity, and safeguards.
This enforcement action is a GDPR matter rather than an EU AI Act decision. However, it is directly relevant to organisations preparing AI systems that process health data, since many such systems fall within the scope of the EU AI Act's high-risk categories, including those listed in Annex III.
As a compliance matter, organisations developing or deploying AI tools involving health data should treat this fine as a reminder that GDPR obligations around special category data continue to apply in full alongside any EU AI Act requirements, and that the two regimes are increasingly enforced in parallel.
Where AI systems rely on health data for training, inference, or decision-support, providers and deployers should review the lawful basis for that processing, the proportionality of data collected, and the robustness of safeguards, rather than treating AI Act compliance as a substitute for existing data protection obligations.