DPA case CNIL2326891X – Violation Found (France, 2023)

The CNIL adopted a reference methodology for processing data from the main base of the National Health Data System (SNDS). This methodology would apply to organisations conducting research, studies, or evaluations in the field of health within the framework of their legitimate interests. Data controllers who meet the conditions set out in the methodology and who submit a declaration of compliance with it are authorised to implement their processing operations, provided that they have also obtained a favourable opinion from an independent community (CESREES); responsible for issuing opinions on proposed studies requiring the use of health data, prior to authorisation by the CNIL. This will ensure that the privacy of individuals is protected while simultaneously facilitating researchers when accessing the SNDS. To begin with, the CNIL reminded that the data controllers concerned with this methodology are only those for whom the implementation of the research, study or evaluation in the field of health is necessary for the pursuit of a legitimate interest within the meaning of Article 6(1)(f) GDPR. The CNIL also clarified that the processing of personal data in these circumstances could be implemented once a controller has made a declaration of conformity with the new reference methodology. Where there is no conformity, the processing must be subject to prior consultation from the CNIL. Additionally, the CNIL provided that every three years, the controller should send the CNIL and the CEREES a report summarising the use of the methodology during this period and that each study should be registered in the public Health Data Hub (PDS) and be published at the end of the data processing. Moreover, the CNIL stated that, in accordance with Article 5(1)(c) GDPR, the processing must be compliant with the principle of data minimisation, meaning that the data must be relevant, adequate and limited to what is necessary for the study for which they are processed. The CNIL als