French Public Health Code
In forceI.-Access to personal data in the national health data system may only be authorised for the purposes of processing:
1° Contributing to a purpose mentioned in III of Article L. 1461-1 and meeting a public interest requirement;
2° or necessary for the performance of the tasks of the competent State services, public establishments or bodies entrusted with a public service mission, under the conditions defined in III of this article.
The person responsible for such processing is only authorised to access data in the national health data system and to carry out matches with this data insofar as these actions are made strictly necessary by the purposes of the processing or by the tasks of the body concerned.
Only persons specifically designated and authorised for this purpose by the data controller, under the conditions specified by the decree in Council of State mentioned in article L. 1461-7, are authorised to access data in the national health data system.
II - The processing of health data mentioned in 1° of I of this article is authorised in accordance with the procedures defined in section 3 of chapter III of title II of the aforementioned law no. 78-17 of 6 January 1978.
Persons producing or marketing products mentioned in II of article L. 5311-1 of this code or the bodies mentioned in 1° of A and 1°, 2°, 3°, 5° and 6° of B of I of article L. 612-2 of the monetary and financial code as well as insurance intermediaries mentioned in article L. 511-1 of the insurance code are required:
1° Either demonstrate that the procedures for implementing the processing make it impossible to use the data for any of the purposes mentioned in V of article L. 1461-1 ;
2° Or use a public or private research laboratory or consultancy to carry out the processing.
The managers of the research laboratories and consultancy firms submit to the Commission nationale de l'informatique et des libertés an undertaking to comply with a set of standards including criteria of confidentiality, expertise and independence, drawn up by the Minister for Health, after obtaining the opinion of the same Commission.
Access to the data is subject to :
a) Before starting to implement the processing, the applicant must provide the public interest group mentioned in Article L. 1462-1 of the study or the assessment of the authorisation of the Commission nationale de l'informatique et des libertés, with a declaration of the applicant's interests in relation to the purpose of the processing and the analysis protocol, specifying in particular the means of assessing its validity and results ;
b) An undertaking by the applicant to communicate to the public interest group mentioned in the same Article L. 1462-1, within a reasonable time after the end of the processing, study or evaluation, the method and, for the processing mentioned in sub-section 2 of section 3 of chapter III of title II of the aforementioned Law No. 78-17 of 6 January 1978, the results of the analysis and the means of assessing their validity.
The public interest group mentioned in the aforementioned Article L. 1462-1 shall publish the authorisation from the Commission nationale de l'informatique et des libertés, the declaration of interests, the results and the method without delay.
III - The decree in Council of State referred to in Article L. 1461-7 sets the list of State services, public establishments or bodies entrusted with a public service mission authorised to process personal data from the national health data system for the purposes of their missions. This decree specifies, for each of these services, establishments or bodies, the scope of this authorisation, the conditions of access to the data and the conditions of access management.
