Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America and Asia-Pacific: 1,846 cases from 39 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by company- Anonymised companies €5.17m 28 % · 10 cases
- IQVIA Operations France €5m 27 % · 1 case
- Australian Clinical Labs Limited €3.28m 18 % · 1 case
- 23andMe, Inc. €2.74m 15 % · 1 case
- IDCQ Hospitales y Sanidad, S.L.U. €1.2m 7 % · 1 case
- Hôpital Privé de la Loire €500,000 3 % · 1 case
- Health Service Executive (HSE) €300,000 2 % · 1 case
- Γενικό Νοσοκομείο Θεσσαλονίκης Γ. Γεννηματάς «Ο Άγιος Δημήτριος» (Allgemeines Krankenhaus Thessaloniki G. Gennimatas – Agios Dimitrios) €25,000 0 % · 1 case
- Azienda Sanitaria Universitaria Friuli Centrale (ASUFC) €24,000 0 % · 1 case
- Specer sp. z o.o. €2,669 0 % · 1 case
- 8 more€3,273
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q4 2023 | 0 | – |
| Q1 2024 | 0 | – |
| Q2 2024 | 0 | – |
| Q3 2024 | 0 | – |
| Q4 2024 | 0 | – |
| Q1 2025 | 0 | – |
| Q2 2025 | 0 | – |
| Q3 2025 | 0 | – |
| Q4 2025 | 0 | – |
| Q1 2026 | 0 | – |
| Q2 2026 | 1 | €5m |
| Q3 2026 | 0 | – |
| Q4 2026 | 0 | – |
1 case
26 May 2026 IQVIA Operations FranceCNIL: €5m fine for IQVIA Operations France over health data warehouses €5m
The CNIL (French data protection authority) fined IQVIA Operations France EUR 5,000,000 because, for two health data warehouses authorised by the CNIL (fed with data from around 14,000 pharmacies and several thousand medical practices), the company did not comply with the conditions of the authorisations, including log analysis, multi-factor authentication, patient information and the right to object. In addition, pharmacy customers were not informed of the transfer of their data, in-house studies were carried out without the required authorisation and the pharmacy software transmitted data even after a refusal (Art. 25 GDPR). The CNIL classified the data as pseudonymised rather than anonymous and ordered remedial action within six months, subject to a penalty payment of EUR 10,000 per day.
Anyone working with authorised health data must implement the conditions of the authorisation technically as well and actively monitor how partners inform the individuals concerned.
Conditions for processing health data
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL), formation restreinte
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 14 und 25 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Healthcare
- Culpability
- negligent
- Mitigating circumstances
- The security shortcomings were remedied after the inspections.
- Published
- 28 May 2026
- CNIL: Données de santé : sanction de 5 millions d'euros à l'encontre de la société IQVIA (28.05.2026) Press release of an authority
- Délibération de la formation restreinte n° SAN-2026-008 du 26 mai 2026 concernant la société IQVIA OPERATIONS FRANCE Decision of an authority
Checked against the official source on 2 Oct 2026 · Direct link