Publication of CNIL standards on health data processing implemented in the context of early access and compassionate use authorisations

The French data protection authority (Commission Nationale de l’Informatique et des Libertés – “CNIL”) has published two standards on health data within the framework of “early access authorisations” (“AAP”)[1] and within the framework of “compassionate access authorisations” (“AAC”)[2]. These standards were adopted after a public consultation by two deliberations of 22 September 2022 and published in the French Official Journal of 10 November 2022.

As a reminder, early access and compassionate use schemes allows patients suffering from a serious, rare, or disabling condition to have access to a medicinal product that is not covered by a marketing authorisation in France in a given therapeutic indication.

For the implementation of these derogatory access schemes, the law requires pharmaceutical companies, with the collaboration of healthcare professionals concerned, to ensure the monitoring of patients benefiting from a medicinal product covered by such schemes (AAP and AAC). The follow-up of patients requires the collection of personal data and the creation of a file record. It was therefore essential for the CNIL to provide standards on health data processing by the pharmaceutical company responsible for the medicinal product covered by AAC or AAP.

From now on, the reference systems will allow the processing of personal data involved in AAP and AAC schemes to be implemented without an authorisation from the CNIL, provided that a declaration of compliance has been made. Indeed, the analysis of compliance of processing with the GDPR and Data Protection Act will be simplified, and the pharmaceutical companies as data controller will simply have to make a declaration of compliance with these standards to the CNIL.

In the event the requirements of the standards cannot all be complied with, a request for authorisation from the CNIL will be necessary.

Finally, it should be noted that these standards do not apply to data processing carried out within the framework of “compassionate prescription frameworks” (“CPC”), which remain subject to CNIL authorisations.

[1] Article L. 5121-12 of the Public Health Code

[2] Article L. 5121-12-1 of the Public Health Code

Written by
Alexandre Vuchot
Alexandre Vuchot
I'm a partner in Bird & Bird's international Commercial group, based in Paris, where I provide our clients with strategic commercial advice. With both French and English qualifications in commercial and corporate law, I have extensive experience of transactional matters. I am able to offer comprehensive advice on all aspects of general business law. I assist on commercial contracts covering distribution, franchise, sales, agency, cooperation and procurement arrangements, acting for suppliers and customers particularly in the retail, tech & comms, life sciences, as well as gaming, entertainment and sport sectors.
Johanna Harelimana
Johanna Harelimana
I am a junior associate, with experience advising clients on regulatory matters across several sectors, especially in life sciences, food and beverages, and environmental sectors. I currently offer both French and international clients legal advice on product's qualification, clinical trials, market access, price and reimbursement, anti-gift regulation, advertising and promotion, e-health (including telemedicine), as well as drafting contracts (distribution, professional services, clinical trial agreements, etc). I also assist with regulatory advice on other products such as cosmetics, biocide, phytopharmaceuticals and novel food.

Related articles

Changes in the Polish Industrial Law concerning Patents
Recent changes to the Polish Industrial Law concerning patents (enacted in October 2019), are due to...
COVID-19: UK Public Health Perspectives
As Novel Coronavirus (COVID-19) continues to spread across the globe, in an effort to prepare for all...
Circular economy: what impact for healthcare players?
Environmental awareness and the desire to limit or eliminate the impact of human activities on the environment...

Leave a comment