Clever Cloud – Court Ruling (France, 2024)

Under [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043894115 Article L. 1461-1 of the French Public Health Code], the public interest group “Plateforme des données de santé” (‘controller’) is responsible for collecting, organising and making data from the national health data system available as well as promoting the use of data in the health sector. The controller wished to implement an automated processing of personal data for the purpose of creating a health data warehouse called EMC2. However, the processing did not comply on certain points with the [https://www.cnil.fr/fr/la-cnil-adopte-un-referentiel-sur-les-entrepots-de-donnees-de-sante guidelines for the processing of personal data for the creation of data warehouses in the healthcare sector] adopted by the French DPA (‘CNIL’). According to [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000038888793 Article 66 of the French Data Protection Act], if processing operations relating to the guarantee of high standards and safety of healthcare do not comply with guidelines adopted by the CNIL, the processing may only be implemented after the CNIL authorises it. Therefore, the controller applied to the CNIL for an authorisation. On 21 December 2023, the CNIL authorised this processing and admitted the legality of hosting health data by a processor, Microsoft Ireland. Therefore, in March 2024, several companies and associations lodged an appeal with the French High Supreme Administrative Court (‘Conseil d’Etat’) asking the suspension of the [https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049057224 CNIL deliberation]. In French law, [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006449326 Article L. 521-1 of the French Code of Administrative Justice] establishes that urgency justifies the suspension of an administrative act when its execution is sufficiently serious and immediate to affect a public interest, the applicant’s situation or the interests they intend to defend. Th