Publication of CNIL standards on health data processing implemented in the context of early access and compassionate use authorisations

The French data protection authority (Commission Nationale de l’Informatique et des Libertés – “CNIL”) has published two standards on health data within the framework of “early access authorisations” (“AAP”)[1] and within the framework of “compassionate access authorisations” (“AAC”)[2]. These standards were adopted after a public consultation by two deliberations of 22 September 2022 and published in the French Official Journal of 10 November 2022.

As a reminder, early access and compassionate use schemes allows patients suffering from a serious, rare, or disabling condition to have access to a medicinal product that is not covered by a marketing authorisation in France in a given therapeutic indication.

For the implementation of these derogatory access schemes, the law requires pharmaceutical companies, with the collaboration of healthcare professionals concerned, to ensure the monitoring of patients benefiting from a medicinal product covered by such schemes (AAP and AAC). The follow-up of patients requires the collection of personal data and the creation of a file record. It was therefore essential for the CNIL to provide standards on health data processing by the pharmaceutical company responsible for the medicinal product covered by AAC or AAP.

From now on, the reference systems will allow the processing of personal data involved in AAP and AAC schemes to be implemented without an authorisation from the CNIL, provided that a declaration of compliance has been made. Indeed, the analysis of compliance of processing with the GDPR and Data Protection Act will be simplified, and the pharmaceutical companies as data controller will simply have to make a declaration of compliance with these standards to the CNIL.

In the event the requirements of the standards cannot all be complied with, a request for authorisation from the CNIL will be necessary.

Finally, it should be noted that these standards do not apply to data processing carried out within the framework of “compassionate prescription frameworks” (“CPC”), which remain subject to CNIL authorisations.

[1] Article L. 5121-12 of the Public Health Code

[2] Article L. 5121-12-1 of the Public Health Code

Written by
Alexandre Vuchot
Alexandre Vuchot
I'm a partner in Bird & Bird's international Commercial group, based in Paris, where I provide our clients with strategic commercial advice. With both French and English qualifications in commercial and corporate law, I have extensive experience of transactional matters. I am able to offer comprehensive advice on all aspects of general business law. I assist on commercial contracts covering distribution, franchise, sales, agency, cooperation and procurement arrangements, acting for suppliers and customers particularly in the retail, tech & comms, life sciences, as well as gaming, entertainment and sport sectors.
Johanna Harelimana
Johanna Harelimana
I am a junior associate, with experience advising clients on regulatory matters across several sectors, especially in life sciences, food and beverages, and environmental sectors. I currently offer both French and international clients legal advice on product's qualification, clinical trials, market access, price and reimbursement, anti-gift regulation, advertising and promotion, e-health (including telemedicine), as well as drafting contracts (distribution, professional services, clinical trial agreements, etc). I also assist with regulatory advice on other products such as cosmetics, biocide, phytopharmaceuticals and novel food.

Related articles

Artificial Intelligence Systems for Medical Diagnosis
The Italian Ministry of Health has published a document on its website entitled “Artificial Intelligence...
UK Clinical Trials Changes – a Leg Up or a Step Down?
The government recently consulted on proposals intended to improve the UK’s clinical trials legislation...

Leave a comment