DPA case CNIL2326885X – Violation Found (France, 2023)

The scope of the National Health Data System has been expanded, both by the Law on the organization and transformation of the health system and by modifying its Implementing Decree. These developments, coupled with a growing interest in this information among stakeholders, have led the CNIL to adopt new reference frameworks allowing access to all the data in the main database of the National Health Data System. The data controller undertakes to only process data that is relevant, adequate and limited to what is necessary for the purposes pursued. The duration of access or retention of data in the controlled environment must be limited to the duration necessary for the implementation of the processing.In any case, this duration cannot exceed five years from the last effective provision of the data.Under certain conditions, this duration may exceptionally be extended.Only people authorized by the data controller or, where applicable, by the person responsible for implementing the processing, can access the data. The implementation of data processing takes place under the responsibility of the data controller, including when it is carried out by third parties acting on its behalf, in compliance with the general data protection regulations.MR-007 legal basis concerns organizations for which the implementation of research, study or evaluation in the field of health is necessary for the performance of a mission in the public interest or is in the exercise of official authority vested in them. MR-007 sets out the purposes of the processing and adds the targeting of centres and/or carrying out feasibility studies for the performance of research involving or not involving the human person.The purposes listed, presumed to be in the public interest, are identical to those mentioned in the reference framework for the provision of the National Health Data System Due to the large volume of data available and the complexity of the available databases, MR-007 require that the pro