FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
The European Health Data Space (EHDS) Regulation (EU) 2025/327 establishing the European Health Data Space (EHDS), will create a harmonised EU framework for accessing and re‑using electronic health data. It will apply from 26 March 2027, with the core secondary‑use regime becoming operational on 26 March 2029. For life sciences companies, the EHDS establishes a structured EU‑wide pathway for secondary use of electronic health data through data permits issued by national Health Data Access Bodies (HDABs) or health data requests, including for scien - tific research and related development or innovation activities (such as algorithm training and evaluation). Access must occur exclusively within a secure pro - cessing environment with strict technical and organi - sational controls, including restricted access and mandatory audit logs. Only non‑personal, anonymised outputs may be exported. Certain purposes – such as advertising or marketing – and any form of re‑identifi - cation are expressly prohibited. Results of secondary use must be published in anonymised form within 18 months. Individuals may opt out of secondary use of their personal electronic health data; where identifi - able, their data may not be used for new permits or newly approved requests, subject to limited excep - tions under national law. Enforcement risks are significant: fines may reach EUR10 million or 2% of global turnover, going up to EUR20 million or 4% of global turnover for serious infringements (including prohibited uses, extraction of personal data from secure environments, and re‑iden - tification). The EHDS applies alongside the GDPR, meaning that parallel GDPR liability may arise. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Applicability of Data Protection Laws to AI In France, the personal data regulatory framework, comprising the EU GDPR and the FDPA, fully applies to the processing of personal data through AI systems. The GDPR already includes rules that are particularly relevant for AI systems, such as the prohibition – sub - ject to certain exceptions – of fully automated deci - sions that produce legal effects or significantly affect the individuals concerned (Article 22 of the GDPR).
The CNIL reference methodologies include MR‑001 (scientific research requiring patients’ consent), MR‑003 (certain research without patient’s consent but with information and a right to object) and MR‑004 (secondary-use studies/research not involving the person). Product and Service Development If R&D is primarily product improvement, commer - cial analytics or model training, it may not qualify as “scientific research” and should be assessed under ordinary GDPR rules: a valid Article 6 legal basis plus, if health data or other special categories of data are processed, an Article 9 (2) condition (often explicit consent). Re-use of consent-based data beyond the original scope generally requires new consent or a new legal basis. Anonymisation as a Data Protection Safeguard The legal provisions outlined above governing sci - entific research and product or service development apply to the processing of “personal” data. Where such data is anonymised in accordance with princi - ples and technical requirements, ensuring no reason - able risk of re-identification (notable in accordance with WP29 Opinion 05/2014), it ceases to constitute personal data. As a result, it falls outside the scope of the GDPR and may be used freely for research or development purposes. True anonymisation is therefore a key privacy pro - tection mechanism and is encouraged in all cases. Moreover, when identifiable data is not strictly nec - essary for the intended processing, anonymisation is required to comply with the GDPR’s data minimisation principle. Anonymisation must not be confused with pseu - donymisation. Pseudonymisation replaces direct identifiers (eg, name, surname) with a code (eg, a number), but the data remains personal as long as a re-identification key exists. A recent CJEU ruling held that, in certain situations, pseudonymised data may be considered anonymous for a third party that can - not reasonably access the key or other re-identifying information.
116 CHAMBERS.COM
Powered by FlippingBook