Privacy & Information Security Law Blog

On March 12, 2021, France’s highest administrative court (the “Conseil d’État”) issued a summary judgment that rejected a request for the suspension of the partnership between the French Ministry of Health and Doctolib, a leading provider of online medical consultations in Europe, for the management of COVID-19 vaccination appointments. The Conseil d’État implicitly recognized that there was a risk of access by U.S. public authorities to the personal data processed, as Doctolib’s platform is hosted in Europe by Amazon Web Services, but nonetheless found that the level of protection for the data was not manifestly insufficient, given the type of the data in question and the safeguards implemented by Doctolib to deal with a possible access request from U.S. public authorities.

Background

As part of the COVID-19 vaccination campaign, the French Ministry of Health entrusted the management of online vaccination appointments to three service providers, including the French company, Doctolib. For the purposes of hosting the data, Doctolib uses the services of AWS Sarl (“AWS”), the Luxembourg affiliate of Amazon Web Services Inc. in the U.S. The personal data is hosted in AWS data centers in France and Germany, and AWS is certified as a health hosting service provider in accordance with the French Code of Public Health.

Several health professional associations and unions appealed to the summary proceedings judge of the Conseil d’État, asking for the suspension of the partnership between the French Ministry of Health and Doctolib and for an order that the Ministry of Health use another solution for the management of vaccination appointments. Substantively, the petitioners argued that the hosting of the data by a European affiliate of a U.S. company entails privacy risks due to possible access requests from U.S. public authorities in the context of U.S. surveillance programs, as highlighted by the Court of Justice of the European Union (“CJEU”) in the Schrems II case. In that case, the CJEU found that the U.S. surveillance programs based on Section 702 of the Foreign Intelligence Surveillance Act (“FISA”) and Executive Order 12333 (“EO 12333”) were not limited to what is strictly necessary, and that the EU-U.S. Privacy Shield Framework did not grant EU individuals actionable rights before a body offering guarantees that are substantially equivalent to those required under EU law. On those grounds, the CJEU declared the EU-U.S. Privacy Shield invalid.

Conseil d’État’s Decision

In its decision, the summary proceedings judge of the Conseil d’État recognized that the contract between Doctolib and AWS did not foresee any data transfers to the U.S. for technical purposes. However, the judge followed in substance the reasoning of the French data protection authority (the “CNIL”) in the Health Data Hub case. In that case, the CNIL considered that the CJEU’s decision in Schrems II also requires examining the lawfulness of a situation in which a service provider processes personal data in the EU but faces the possibility of having to transfer the data following an administrative or judicial order or a request from U.S. intelligence services, because that service provider is the EU affiliate of a U.S. company. Accordingly, with respect to Doctolib, the judge found that it was necessary to verify the level of protection for the personal data processed by Doctolib, taking into account not only the contractual safeguards between Doctolib and its data processor, AWS, but also the relevant elements of the U.S. legal system when the data processor is subject to U.S. laws, even indirectly.

When making that assessment, the judge took into account the type of personal data processed by Doctolib. Contrary to what was alleged by the petitioners, no health data was processed by Doctolib as part of the vaccination campaign. The data hosted by Doctolib only included identification data and information on vaccination appointments but did not include any information about the reason why the individual was eligible for priority in vaccination because of a specific pathology. In addition, the judge noted that the personal data hosted by Doctolib was deleted after three months and that individuals could delete the data directly online. As part of the contractual safeguards, the judge further noted that the contract between Doctolib and AWS provides for a specific procedure for handling access requests from a foreign authority, including the guarantee that AWS will challenge any general access request or any request that does not comply with European law. Finally, as part of the technical safeguards, the judge noted that the data hosted by AWS is encrypted and the encryption key is held by a trusted third party in France and not by AWS. The judge concluded that the level of data protection was not manifestly insufficient in light of the risk of U.S. authorities requesting the data. The judge therefore rejected the request of the applicant associations and unions.

Read the press release (in English) and full summary judgment of the Conseil d’État (in French)