The French Supervisory Authority Fines CEGEDIM SANTÉ € 800 000

On September 19, 2024, the European Data Protection Board (“EDPB”) published on its official website the news that French Supervisory Authority (“The French SA”) carried out investigations in 2021 which revealed, in connection with the use of one of its software products, that the company CEGEDIM SANTÉ had processed, without authorisation, non-anonymous health data, transmitted to its customers in order to carry out studies and produce statistics in the health sector.

According to the announcement;

• Firstly, French SA's investigations revealed that data were not anonymous, but only pseudonymous, since it was technically possible to re-identify the people concerned. As this involved the processing of personal data, the company should have obtained authorisation from the French SA to use them (Article 66.III of the French Data Protection Act).
• To assess whether or not the data processed is anonymous, the restricted committee focused on determining whether the data subjects could be re-identified by reasonable means, as provided for by the case law of the Court of Justice of the European Union and the work carried out by data protection authorities at European level (Article 29 Working Party, Opinion 05/2014 on anonymization techniques of April 10, 2014).

As a result;

• The French SA found two breaches: Failure to comply with the obligation to carry out prior formalities in the health sector regarding French law (Article 66 of the French Data Protection Act). The restricted committee considered that the company did not submit any request for authorisation to the French SA and didn’t send a declaration of compliance with one of its repositories to the French SA, even though it constituted a health data warehouse.
• Failure to comply with the obligation to process data lawfully (Article 5.1.a of the GDPR). The company used the “HRi” teleservice set up by the health insurance, which provides access to the history of health reimbursements made by the health insurance for a patient over the last twelve months. However, that consultation of the data from this teleservice by a doctor who was a member of the "observatory" automatically led to the data being downloaded into the electronic patient file, enabling the company to collect it at the same time.  The restricted committee considered that, by not providing for the possibility of data simply being consulted by doctors without leading to automatic collection, the company had not processed the data lawfully.
• The French SA imposed a fine of EUR 800 000 on CEGEDIM SANTÉ.

You can reach further information here.

You can reach the French SA’s press release (in French) here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr