CRPA, LDH and MGEN ASS – Court Ruling (France, 2020)

The NGOs, Circle for reflection and proposal of actions on psychiatry (CRPA), The Human Rights League (LDH) and the French organism fight for social welfare (MGEN ASS) brought action for annulment before the Supreme Administrative Court (the Council of State ‘CE’). The complainants requested, inter alia, the annulment of the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data of persons in psychiatric care without consent for monitoring purposes, for misuse of authority. The decree from 2018 (without modification) allows the processing of personal data of persons in psychiatric care without their consent for monitoring purposes. The amending decree adds a further processing which is to inform State representatives of new admissions of persons in psychiatric care without their consent. The same decree states that this other processing is the prevention of terrorist radicalization, within the meaning of the French criminal law. The Complainants argued that that new processing infringed Articles 9, 12, 13, 14, 16 and 17 GDPR. The Court had to assess which legal was applicable and whether the further processing is lawful. The Supreme Administrative Court decided First, on the link between the two processing aforementioned, the Court ruled that the two processing operations constitute themselves one and only operation. It issued that the legal framework applicable to such processing depends on the purpose thus pursued. Secondly, the Court issues that the purpose of such processing to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Thus, the processing is in the field of State Security and Defence and falls outside the scope of Union law, as foreseen in Article 2(2)(a) GDPR. More precisely, the processing is subject to the specific provisions for processing carried out on behalf of the State and relating to State security or defence in the French Data Protection and Freedom of Information Law (Loi Informatique et Liberté) Thirdly, the Court pointed the processing was limited to what is was necessary to achieve the purpose. Indeed, the controllers are solely processing the data needed for the identification of the person. Thus, the data processed are adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment Fourthly, the Court ruled that personal data related to health are lawfully processed for public interests. Additionally, the Court issued that the plea alleging infringement of Article 8 of the Charter of Fundamental Right was not substantiated and thus, rejected. Finally, the Court rejected the other argument related to the competence of the enacting authority and to French administrative procedure. As a consequence, the Court ruled that the actions were rejected and that the decree is lawful.