Court case N° 503163 – Court Ruling (France, 2025)

An association, les Licornes Ceélestes, brought an action before the Conseil d’Etat (Supreme Administrative Court) seeking, on a interim basis, the suspension of the execution of an order of the CNIL authorising the European Medicines Agency (EMA) to implement automated processing of the personal data of the general population in France for a study on the incidence and prevalence of pathologies within the framework of the “DARWIN EU” project. In the alternative, they sought a referral of questions to the CJEU concerning the validity, in light of the Charter, of Commission Implementing decision (EU) No 2023/1995 (authorising the EU-US Data Privacy Framework. The organisation claimed that the requisite urgency condition for such interim relief is satisfied as the propose processing concerns the health data of 10 million French people which would be hosted by Microsoft. This would necessitate transfers to the US where, they allege, there are insufficient guarantees as to the protection of personal data. The organisation further argued that there exists doubt as to the legality of the Commission’s decision to authorise the transfer, that it contains serious errors of law, fact and assessment by stating that no transfer to the US will take place when Microsoft cannot technically guarantee that the processing will occur solely in the EU. The organisation noted that the authorisation which permitted “technical usage data” to be transferred to the US incorrectly regarded this type of data as not constituting personal data. The Court noted that the standard required for the awarding of interim relief in this scenario is that the contested administrative decision causes a sufficiently serious and immediate harm to a public interest and whether it is sufficiently serious to warrant intervention pending a full hearing on the matter. Although acknowledging the risk of a request for access to the data by the US, the Court characterized this risk as “hypothetical” in light of the study. The Court also referenced the fact that Microsoft Ireland is certified under French law as a “health data host” (HDH), which indicates compliance with a security framework and being subjected to regular monitoring by an accredited body, specifically pseudonymization techniques which render the data not directly identifiable. The Court was also influenced by the public interest in not delaying the project, noting that according to a study submitted to the court by the public interest group Plateforme des données de santé, there were no solutions identified which could offer the same functionalities and better overall security than that offered through Microsoft. In light of these factors, the Court concluded that the requisite condition of urgency had not been met and the application for interim suspension was rejected.