Revised French Personal Data Protection Act: Constitutional Court upholds health related provisions included in the bill

On 22 June 2018, a new law entered into force, after the French parliament amended the personal data protection bill to reflect a decision of the French Constitutional Court. The court had indeed earlier upheld the majority of the provisions of the French personal data protection bill, which amends Act n. 78-17 on Information Technology, Data Files and Civil Liberties (Loi Informatique et Libertés) in order to comply with the EU General Data Protection Regulation ((EU) 2016/679) (GDPR).

In particular, the court upheld the constitutionality of Article 16 of the bill, relating to the processing of personal health data. Article 16 of the bill amends Article 53 of Act n.78-17 which only allows the processing of personal health data for the purposes of medical research under certain conditions, with a few exceptions (chapter IX). Article 16 expands these exceptions to the processing of data necessary to ensure: (i) the performance of acts or control by the bodies responsible for the management of a basic health insurance scheme; and (ii) "the reimbursement of medical acts by the supplementary health insurance bodies".

The bill was challenged by more than 60 senators who sought annulment of, among others, Article 16 on grounds that the exception foreseen for "the reimbursement of acts by the supplementary health insurance bodies" would let private supplementary health insurance bodies access patient health data without prior consent and use said data to fix insurance primes or make medical choices. The court rejected this argument. It held that this exception is restricted to the application of certain provisions of Act n. 78-17 (chapter IX) but does not exclude the application of the remaining provisions of the act as well as of the GDPR. In particular, Article 5 of the GDPR which prohibits (health) data processing in a manner that is incompatible with the original purpose of the processing must be complied with. The court also held that the contested provision did not let supplementary health insurance bodies impose the choice of certain physicians on the insured patient base, and left physicians the choice on which therapy is most suitable for the patient.

A prior version of this post was originally published by the same authors in Practical Law – Life Sciences, June 2018 Issue (Thomson Reuters).

This post was originally co-authored by Patricia Carmona Botana.