Support Centre

France: CNIL publishes guidance on the health data hub

The French data protection authority ('CNIL') published, on 11 June 2020, guidance ('the Guidance') on the health data hub ('the Hub') which aims to facilitate the sharing of health data and promote research. In particular, the Guidance provides information on, among other things, the Hub's objectives, CNIL's authorisation of research projects carried out on the Hub, as well as CNIL's recommendations for using the Hub. More specifically, the Guidance notes that, in accordance with Article L. 1462-1 of the Public Health Code (as amended), the objectives behind the Hub include informing patients and facilitating the exercise of their rights, contributing to the development of the CNIL standards, and the exchange of health data sets while safeguarding privacy. In addition, the Guidance highlights that, in light of the COVID-19 ('Coronavirus') emergency, there exist risks related to data security and third-party access with using the Hub, that the creation of a health data warehouse within the Hub requires prior authorisation by CNIL, and that transfers of such data outside the EU would be governed by Standard Contractual Clauses ('SCCs') in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). Moreover, the Guidance urges the adoption of measures to ensure security of the data available in the Hub and recommends that, given the sensitivity of the data, any entities responsible for managing the Hub fall exclusively within the jurisdiction of the EU.  

You can read the Guidance, only available in French, here