On February 6, 2023, the CNIL published two guidance sheets to help data controllers navigate the process of submitting authorization requests for health-related data processing. These apply to both research-related and non-research-related health data processing.
When submitting an authorization request to the CNIL
The characteristics of the processing must be detailed so that the CNIL can ensure that the proposed processing complies with the GDPR, the French Data Protection Act (Informatique et Libertés law), and other applicable regulations, such as those in the French Public Health Code.
Before granting authorization, the CNIL will also verify other criteria, such as:
- The designation of a data controller
- The framework governing relationships with various stakeholders (processors, implementation managers)
- Justification of a public interest purpose
- The legal basis for processing
When submitting an authorization request for health research
It is necessary to ensure that:
- The project falls under the French Data Protection Act
- The project qualifies as research, study, or evaluation in the health sector under this law
- The research involves human subjects
- The project strictly complies with the applicable regulatory framework for this type of study
When submitting an authorization request for health-related processing outside the research field
The following must be verified:
- Whether the intended processing will involve health data
- Whether it constitutes the processing of personal data in the health sector
- Whether it falls within the exceptions provided under Article 65 of the French Data Protection Act and whether the CNIL has established a reference framework for this type of processing
If the proposed processing does not fully comply with the applicable reference framework, an authorization request must be submitted to the CNIL.
For more information:
- “Health authorization requests: CNIL publishes compliance criteria,” CNIL, February 6, 2023
- “Authorization request for health research: Required information and granting criteria,” CNIL, February 6, 2023
- “Authorization request in the health sector (non-research): Required information and granting criteria,” CNIL, February 6, 2023
