Clever Cloud – Court Ruling (France, 2024)

Under [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043894115 Article L. 1461-1 of the French Public Health Code], the public interest group “Plateforme des données de santé” (‘controller’) is responsible for collecting, organising and making data from the national health data system available as well as promoting the use of data in the health sector. The controller wished to implement an automated processing of personal data for the purpose of creating a health data warehouse called EMC2. However, the processing did not comply on certain points with the [https://www.cnil.fr/fr/la-cnil-adopte-un-referentiel-sur-les-entrepots-de-donnees-de-sante guidelines for the processing of personal data for the creation of data warehouses in the healthcare sector] adopted by the French DPA (‘CNIL’). According to [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000038888793 Article 66 of the French Data Protection Act], if processing operations relating to the guarantee of high standards and safety of healthcare do not comply with guidelines adopted by the CNIL, the processing may only be implemented after the CNIL authorises it. Therefore, the controller applied to the CNIL for an authorisation. On 21 December 2023, the CNIL authorised this processing and admitted the legality of hosting health data by a processor, Microsoft Ireland. Therefore, in March 2024, several companies and associations lodged an appeal with the French High Supreme Administrative Court (‘Conseil d’Etat’) asking the suspension of the [https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049057224 CNIL deliberation]. In French law, [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006449326 Article L. 521-1 of the French Code of Administrative Justice] establishes that urgency justifies the suspension of an administrative act when its execution is sufficiently serious and immediate to affect a public interest, the applicant’s situation or the interests they intend to defend. The judge must take into account the justifications provided by the applicant as to whether the effects of the disputed act characterise an urgency justifying that the execution of the decision be suspended. Urgency must be assessed objectively, taking into account all the circumstances of the case. In the present case, the applicants argued that they market services linked to cloud data hosting without being exposed to the risk of extra-territorial application of US law. However, this authorisation of the CNIL admits the legality of hosting sensitive data by Microsoft Ireland acting as a processor, whose parent company is subject to US law. The applicants considered that this seriously harms their economic interests. They also argued that the implementation of this processing would expose health data concerning several million people to a non-negligible risk of disclosure to administrative or judicial authorities in the United States. They pointed out that if Microsoft is unable to oppose requests made by these entities under Section 702 Foreign Intelligence Surveillance Act (FISA), Executive Order 12333 or the Clarifying Lawful Oversight Use of Data Act (CLOUD Act), it would cause serious and immediate harm to the interests of the applicants. Additionally, they asked the Conseil d’Etat to refer a question to the CJEU on the assessment of the validity of the Data Privacy Framework and at least refer the following questions: # US law continues to provide for rules enabling public authorities to gain general access, without judicial review, to the content of electronic communications of EU nationals hosted on or in transit to US territory. Is such a limitation of rights framed in such a way to meet the requirements of EU law, in particular [https://fra.europa.eu/en/eu-charter/article/52-scope-and-interpretation-rights-and-principles Article 52(1) of the Charter of fundamental rights]? # US law does not provide any possibility for individuals to exercise legal remedies to prevent access to personal data concerning them, or to obtain the communication, rectification or deletion of such data. Is this practice compatible with EU law, in particular [https://fra.europa.eu/en/eu-charter/article/47-right-effective-remedy-and-fair-trial Article 47 of the Charter of fundamental rights]? # Does the new Data Privacy Framework comply with the Charter of Fundamental rights, in particular [https://fra.europa.eu/sq/eu-charter/article/7-respect-private-and-family-life Articles 7], [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data 8] and [https://fra.europa.eu/en/eu-charter/article/47-right-effective-remedy-and-fair-trial 47]? First, the Conseil d’Etat pointed out that on the one hand, during the investigation for the authorisation, the CNIL requested that a team of experts examined the possibility of carrying out the EMC2 project using a cloud provider free from any risk of extraterritorial application of the law of a third country. In December 2023, this mission concluded that no available solution would meet such a requirement and meet the technical needs of the project within the required time frame. On the other hand, the Conseil d’Etat considered that the execution of the contested decision was only likely to have an indirect and limited impact on the activities of the applicants. Therefore, the Conseil d’Etat held that the implementation of the contested decision was not likely to cause serious and immediate harm to the interests of the applicants. Second, the EMC2 data warehouse is intended to process data from the medical files of 300,000 to 500,000 patients treated each year in four hospitals. This data will then be matched with the data concerning them contained in the national health database (‘SNDS database’) which concerns around 1,5 million people. Under the terms of the authorisation, only pseudonymised data will be collected within the EMC2 data warehouse, and patients National Identification Numbers and full date of birth will not be retained. Additionally, the data in the EMC2 data warehouse will be stored in Microsoft data centers located in France. On the one hand, the Stored Communications Act as amended by the CLOUD Act provides that companies subject to U.S. law within the meaning of that Act may be required to provide data they control, regardless of where it is hosted, when such provision is authorized by a judge for the purposes of a criminal investigation. While these provisions apply to Microsoft, the Conseil d’Etat considered that the applicants did not provide any evidence to suggest that the pseudonymised health data hosted by Microsoft could be the subject of requests on this basis. On the other hand, the Conseil d’Etat held that the risk that the US authorities might request access to certain data processed and hosted in the EMC2 warehouse cannot in principle be totally ruled out. However, they found that the risk of these authorities gaining access to the data, if Microsoft does not object to such a request, was hypothetical at the stage of the investigation, in view of the safeguards implemented, in particular the fact that the data will be pseudonymised and not directly identifiable. Therefore, in view of the precautions taken, the Conseil d’Etat judged that the implementation of the contested decision could not be considered as a serious and immediate infringement of the right to privacy of the persons concerned. The Conseil d’Etat added that the public interest in ensuring that the project contributes to the European Medicines Agency’s project to pool ‘real life databases’ in order to enable research, studies and evaluations to be carried out on the use, efficacy and risks of a large panel of medicines and medical devices marketed in France, justified not suspending the contested authorisation. Therefore, the Conseil d’Etat concluded that the condition of urgency required by [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006449326 Article L. 521-1 of the French Code of Administrative Justice] were not met. Consequently, the Conseil d'Etat considered that there was no need to refer the questions to the CJEU and the request was rejected.