FRANCE Law and Practice Contributed by: Frédéric Sardain and Claire Allavena, Jeantet
5.3 Data Localisation Requirements French public health code requires that health data must be hosted by an “HDS”-certified host - ing provider and be exclusively hosted in a coun - try within the “European Economic Area” (EEA). This localisation requirement provides important guarantees in terms of data protection and helps strengthen the confidence of patients and pro - fessionals in digital healthcare, as well as con - tributing to the emergence of an ecosystem of European players. The “SecNumCloud standards”, published by the ANSSI, is a reference framework for cloud service providers. SecNumCloud requires per - sonal data to be stored and processed within the EEA. Moreover, the French government encour - ages public bodies to host “particularly sensi - tive” data only on SecNumCloud-qualified cloud offerings. France’s Blocking Statute (Law No 68-678, strengthened in 1980) restricts the transfer of sensitive economic, commercial, industrial, financial, or technical information to foreign authorities. This restriction applies to French citizens, residents, and companies operating in France unless permitted by international treaties. The law protects information potentially harming French sovereignty, security, essential econom - ic interests, or public order. Since 1 April 2022, French companies receiving such requests must immediately report them to the Strategic Infor - mation and Economic Security Service (SISSE). 5.4 Blocking Statutes French Law No 68-678 of 26 July 1968, also known as the “French Blocking Statute” modi - fied by Law n° 80-538 of 16 July 1980, deals with the communication of certain types of infor - mation to foreign entities. This law is notably a response to American courts’ use of the dis -
covery procedure, which allows strategic data to be communicated during legal proceedings with rival companies. This law aims to protect France’s economic interests by limiting the transmission of certain sensitive information abroad. It covers two things: • the communication of information by French nationals or residents to foreign public authorities that could harm national interests or public order; and • the exchange of information to gather evi - dence for or in the context of foreign judicial or administrative proceedings. French Blocking Statute prohibits any individual or legal entity from communicating these types of information to foreign public authorities except within the framework of international treaties or agreements. It requires prior authorisation from the French government to communicate such information (for example, international judicial cooperation, cross-border merger and acquisi - tion, international banking compliance). Violating this law can result in criminal sanctions, includ - ing fines and imprisonment. It applies not only to acts committed in France but also abroad by French persons or entities. In view of the growing use of laws with extrater - ritorial reach by foreign players and the lack of dissuasive effect of the French Blocking Statute, the decree of 18 February 2022 and the order of 7 March 2022 have clarified the procedure for companies and designated the Strategic Information and Economic Security Department (SISSE) as the single point of contact. SISSE will assist French companies, in liaison with the various government departments, to meet the
137 CHAMBERS.COM
Powered by FlippingBook