Duyurular

French Data Protection Authority Imposes Sanctions on Leading Clinical Research and Health Data Provider for Unlawful Processing and Security Shortfalls

The Restricted Committee of the Commission Nationale de l’Informatique et des Libertés (“CNIL”) has imposed a €5,000,000 administrative fine and a series of compliance injunctions on a major clinical research and health data provider under Deliberation No. SAN-2026-008.

The decision follows CNIL investigations into the provider’s large-scale health data warehouses, known as “LRX” and “EMR”, and concerns violations of the GDPR and the French Data Protection Act.

Within the scope of the deliberation, the CNIL made the following key determinations:

  • A €5,000,000 administrative fine was imposed on the provider for infringements of Article 66 of the French Data Protection Act and Articles 14 and 25 of the GDPR. In determining the amount of the fine, the CNIL took into account the economic capacity of the group as a single economic unit, including the global turnover of its ultimate parent company.
  • The CNIL confirmed that the pseudonymized health data contained in the LRX and EMR warehouses remained personal data. The fact that the data were pseudonymized did not, in the circumstances of the case, make them anonymous. In particular, the CNIL considered the nature and richness of the health data, their longitudinal character, the existence of unique identifiers, and the possibility of re-identification using reasonably likely means.
  • The provider was found to be the data controller for the processing operations relating to the constitution and operation of the LRX and EMR warehouses. The CNIL emphasized that the involvement of different actors, including pharmacies, physicians and software providers, in the collection and transmission process did not relieve the provider of its responsibilities as controller.
  • The CNIL found several breaches of the requirements contained in the CNIL authorizations governing the LRX and EMR warehouses, including deficiencies relating to network segmentation, strong authentication, and the monitoring and analysis of access logs. The CNIL subsequently acknowledged that the provider had implemented corrective measures, including multi-factor authentication, a secure network enclave, and enhanced audit-trail and alerting mechanisms, and therefore did not issue further injunctions in respect of those security-related deficiencies.
  • A breach of Article 14 of the GDPR was established in relation to the LRX warehouse. Inspections at four pharmacies participating in the LRX panel showed that patients had not been provided with the required individual information notice and that the required general information had not been displayed. The CNIL held that, as the controller of the relevant processing, the provider remained responsible for ensuring that data subjects were effectively informed, notwithstanding the contractual role assigned to pharmacies in delivering that information.
  • The CNIL also found that information provided to patients concerning the EMR warehouse was inaccurate. The notices stated that data would be retained for the duration of the relevant studies and analyses and subsequently archived, whereas the applicable CNIL authorization provided for retention in the active database for ten years, followed by anonymization or deletion. The CNIL regarded this as a failure to comply with the terms of the authorization under Article 66 of the French Data Protection Act.
  • The decision identified significant shortcomings concerning the effective exercise of data subjects’ rights, in particular the right to object in relation to data already stored in the EMR warehouse. Although patients could object prospectively before their data entered the warehouse, the mechanism for exercising the right in respect of data already collected required patients to provide detailed information so that the provider could attempt to re-identify them. The CNIL considered this procedure too complex and uncertain to constitute an effective operational mechanism for exercising the right to object.
  • The CNIL held that research studies conducted using data from the LRX warehouse were not covered by the original CNIL authorization for the constitution of the warehouse. Nor could the provider rely on the MR-004 reference methodology, because the required prior and individual information had not been provided to the relevant data subjects. Accordingly, the studies based on data collected through the four inspected pharmacies were found to have been carried out outside the applicable legal framework, constituting a breach of Article 66 of the French Data Protection Act.
  • The CNIL found a violation of Article 25 of the GDPR (Data Protection by Design and by Default) because the pharmacy software extraction modules systematically transmitted patient data to the first trusted third party, including in cases where pharmacies had chosen not to transmit patient data to the provider for the LRX panel. The CNIL held that the filtering mechanism should have operated at the level of the pharmacy software so that data that were not intended to be processed were not extracted and transmitted in the first place.
  • The CNIL emphasized the large scale and sensitivity of the processing. The LRX and EMR systems involved health data concerning potentially tens of millions of individuals. The CNIL considered the infringements particularly serious given the sensitivity of health data, the indirect manner in which the data were collected, the resulting impact on individuals’ ability to understand and control the processing of their data, and the provider’s expertise and resources in the health data sector.
  • In addition to the administrative fine, the CNIL issued a formal compliance injunction requiring the provider to remedy the remaining infringements. The measures include ensuring accurate and complete information to EMR patients, establishing an effective mechanism for exercising the right to object, ensuring that partner pharmacies effectively inform patients, ceasing LRX-based studies unless they are covered by a CNIL authorization or comply with MR-004, and preventing pharmacy software from extracting patient data where transmission has been refused.
  • The compliance injunction is subject to a daily penalty of €10,000 for each day of delay, applicable following a six-month period from notification of the decision.
  • Finally, the CNIL ordered the publication of the decision on the CNIL website and Légifrance. The decision provides that the provider will no longer be identified by name in the published decision after two years. The decision may be challenged before the French Conseil d’État within two months of notification.

 

You can access the full text of Deliberation No. SAN-2026-008 here.

 

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

 

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.