Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

France: Conseil d'Etat rules that Health Data Hub should not be suspended

The Conseil d'Etat announced, on 14 October 2020, that it has issued a summary judgment, on 13 October 2020, on the topic of whether the Health Data Hub should be suspended following the issuance of a decree that has prevented the Health Data Hub to transfer personal data to third countries and the French data protection authority ('CNIL') made a statement on the same. In particular, several associations and unions appealed to the Conseil d'Etat for the suspension of the Health Data Hub due to the use of Microsoft Corporation to host the Health Data Hub and the Court of Justice of the European Union ('CJEU') judgment in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('the Schrems II Case') finding that the access to European citizens' data by US surveillance authorities had been excessive. In relation to this appeal, the judge of the summary proceedings before the Conseil d'Etat held that there is no adequate justification for suspending the data processing activities conducted by the Health Data Hub and that precautions must be taken until a solution that eliminates any risk of US authorities accessing personal data is established. More specifically, the judge noted the Government's aim to use French or European platforms for hosting the Health Data Hub and requested the Health Data Hub to minimise any risk by concluding a new agreement with Microsoft. Moreover, the judge noted that, while the Health Data Hub and Microsoft Corporation have contractually agreed to refuse any transfer of health data outside the EU, the processing of such data by an American company within EU territory has not been prohibited. Lastly, the judge highlighted that, in light of the Coronavirus pandemic, there is an important public interest in allowing the continuous processing of health data as enabled by the Health Data Hub and, therefore, held that the Health Data Hub should not be banned.  

In relation to the above, CNIL noted that the choice of a host which is subject to US law and may be asked to respond to data access requests seems problematic as well as incompatible with the Schrems II judgment. Lastly, CNIL stated that, in light of the judge's ruling, it will assess any requests for authorisation of research projects using the Health Data Hub, as well as provide guidance to public authorities in relation to the implementation of long-term guarantees. 

You can read the announcement here, CNIL's statement here, and download the summary judgment here, all only available in French.  

Feedback