French Ministry of Health – Violation Found (France, 2020)

In the context of the worldwide health crisis caused by Covid-19, the French Ministry of Health decided to make an application available to its citizens, aiming to improve the detection process of infections. The application "StopCovid" thus enables its users to inform their phone contacts, whom they have recently met or even only shortly been in contact with, if they have been infected with the virus. The users can also be informed by the application if they have encountered or found themselves at proximity of another user of the application who has declared having been infected. With regard to the nature of the data processing and the important number of users, the CNIL decided to investigate in order to make sure that the processing be carried out in accordance with the applicable provisions. Is the application "StopCovid" compliant with the applicable provisions of the GDPR and the national data protection law? The CNIL held that, in the main, the application "StopCovid" complied with the applicable data protection laws. However, the authority revealed a failure to comply with some of the provisions of the GDPR and the "loi informatique et libertés". Regarding, on one hand, the violation of the GDPR, the CNIL reminded the Ministry of Health that data has to be processed lawfully, fairly and in a transparent manner in relation to the data subject (Art. 5(1)(a) GDPR). The fact that when the information given by the user, indicating they had been infected by the Covid-19, was transferred to all their contacts and not only to the contacts they had recently found themselves at proximity of, was a direct violation of the principle of lawfulness and the Art. 2(5) of the national decree relating to the data processing carried out through "StopCovid". Moreover, the privacy policy aiming to inform the users of the data processing lacked precision regarding categories of data being processed and recipients of the data. A data processor being involved in the processing, the authority also found that the contract required by Art. 28 GDPR was missing dispositions as to the rights and obligations of the Ministry, assistance with data subjects requests, security of processing, documentation of processing and audit. Furthermore, the data protection impact assessment was considered incomplete, the data processing caused by the use of the "Captcha" verification solution not having been part of the assessment. Regarding, on the other hand, the violation of the national data protection law, the CNIL pointed out that the Art. 82 of the "loi informatique et libertés" required that for any data processing resulting from the use of electronic services such as the Google Captcha solution, the user had to be informed and asked to give their consent prior to the processing. Yet neither were the users informed of the data processing by Google, nor were they asked to give their consent. That is why CNIL summoned the Ministry of Health to address those violations within a month and report back to confirm the implementation of all corrective measures.