# CEGEDIM SANTÉ: Non-compliance with general data processing principles

- Type: Enforcement
- Source: French Data Protection Authority (CNIL)
- Date: 2024-09-12
- Original: https://www.enforcementtracker.com/ETid-2542
- Canonical: https://overview.legal/posts/48657
- Topics: Anonymization, IP Address, Healthcare, Healthcare, Processing Agreement, Pseudonymization, Processing, International Transfer, Scientific Research, Supervisory Authorities

## Summary

The French DPA has imposed a fine of EUR 800,000 on CEGEDIM SANTÉ. The company, which provides software for medical practices, had transferred customer data for research purposes. However, the DPA found that this data was not anonymous but only pseudonymized, making re-identification possible.

## Full text

The French DPA has imposed a fine of EUR 800,000 on CEGEDIM SANTÉ. The company, which provides software for medical practices, had transferred customer data for research purposes. However, the DPA found that this data was not anonymous but only pseudonymized, making re-identification possible.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 66 Loi n° 78-17 du 6 janvier 1978
Industry: Health Care

---
Generated by overview.legal · https://overview.legal/posts/48657 · 2026-08-22