Syndicat de la Médecine Générale (SMG) – Court Ruling (France, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The French Supreme Administrative Court reviewed whether the Health Data Hub's use of Microsoft services violated privacy laws after the Schrems II decision. The court considered the risks of US surveillance laws on European data. This case underscores the need for companies to reassess data transfer agreements with US-based firms.
What happened
The French court examined if the Health Data Hub's contract with Microsoft complied with GDPR after the Schrems II ruling.
Who was affected
Individuals whose health data was processed on the Health Data Hub and potentially exposed to US surveillance.
What the authority found
The court highlighted the need for data transfers to third countries to ensure protection equivalent to GDPR standards, referencing the Schrems II decision.
Why this matters
This ruling stresses the importance of reassessing data transfer agreements with US companies in light of the Schrems II decision. Businesses should ensure their contracts provide adequate data protection to comply with GDPR.
GDPR Articles Cited
National Law Articles
The parties asked the French Supreme Administrative Court (Conseil d’Etat) to suspend the centralisation and data processing of personal data relating to Covid-19 on the health data platform ‘Health Data Hub’ (data controller). The EU subsidiary of the American corporation Microsoft, established in Ireland, has access to personal data on the Hub as it licenses the software necessary to operate it (data processor). The data centre is located in the Netherlands. The parties also asked the Court to request the French DPA (CNIL) to rule on the implication of the invalidation of the Privacy Shield agreement in relation to personal data processed in the Health Data Hub. The parties highlighted that the condition of urgency was met. This is due to the urgent nature of the Covid-19 pandemic, the sensitive nature of the data centralised and processed in the Health Data Hub and the recent CJEU decision (“Schrems II” of the 16th July 2020). Finally, they deemed that there was a serious violation of the right to privacy and to protection of personal data. This is due to the fact that the company in charge of the Health Data Hub’s technical aspects, Microsoft, is subject to US law. The risk that this posed to the above-mentioned rights were outlined in the Schrems II decision. Is the contract between the French Health Data Hub and Microsoft, as a company subject to US surveillance law, in violation of Article 44 to 49 GDPR following the Schrems II decision? With regard to the Schrems II decision: The French Court outlined relevant segments in the the Schrems II CJEU decision. In this case, the CJEU held that Articles 46(1) and 46(2)(c) GDPR must be interpreted as meaning that a data subject, whose personal data is transferred to a third country, benefits from a level of protection essentially equivalent to that guaranteed by the GDPR and the EU Charter of Fundamental Rights. The French Court also highlighted that the CJEU held that the Privacy Shield adequacy decision (
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Syndicat de la Médecine Générale (SMG) in FR
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Syndicat de la Médecine Générale (SMG) - France (2020). Retrieved from cookiefines.eu
Last updated: