Privacy & Information Security Law Blog

On October 13, 2020, France’s highest administrative court (the “Conseil d’État”) issued a summary judgment that rejected a request for the suspension of France’s centralized health data platform, Health Data Hub (the “HDH”), currently hosted by Microsoft. However, the Conseil d’État recognized that there is a risk of U.S. intelligence services requesting the data and called for additional guarantees under the control of the French data protection authority (the “CNIL”).

Background

France’s HDH is born from the French Government’s willingness to build a hub that makes it easier to study rare diseases and use artificial intelligence to improve diagnoses. To that end, the HDH is supposed to consolidate all health data of people receiving medical care in France in order to facilitate data sharing and promote medical research. The HDH was put in service early in April 2020 to manage the COVID-19 health crisis and improve knowledge. The French Government initially chose to partner with Microsoft and its cloud platform Azure; on April 15, 2020, the HDH signed a contract with Microsoft’s Irish affiliate to host the health data in data centers in the EU.

On September 28, 2020, several associations, unions and individual applicants appealed to the summary proceedings judge of the Conseil d’État, asking for the suspension of the processing of health data related to the COVID-19 pandemic in the HDH. In substance, the petitioners argued that the hosting of the data by a company subject to U.S. laws entails privacy risks due to possible transfers of the data to U.S. intelligence services, as highlighted by the Court of Justice of the European Union (“CJEU”) in the Schrems II case. In this case, the CJEU found that the U.S. surveillance programs based on Section 702 of the Foreign Intelligence Surveillance Act (“FISA”) and Executive Order 12333 (“EO 12333”) were not limited to what is strictly necessary, and that the EU-U.S. Privacy Shield Framework did not grant EU individuals actionable rights before a body offering guarantees that are substantially equivalent to those required under EU law. On those grounds, the CJEU declared the EU-U.S. Privacy Shield invalid.

On October 8, 2020, the CNIL submitted comments on the summary proceeding before the Conseil d’État. On the same day, the French Secretary of State for Digital announced that the French government was looking to transfer the HDH to a French or European platform. On October 9, 2020, a French Ministerial Order was adopted prohibiting any data transfers outside of the EU from the HDH.

CNIL’s Comments

Although the CNIL made it clear that its comments only relate to the specific case of health data, the comments offer insight into the CNIL’s position on the consequences of the Schrems II case and the types of additional safeguards that organizations could implement in addition to a contractual data transfer mechanism (in practice, Standard Contractual Clauses) in order to validly transfer personal data to the U.S.

In the CNIL’s view, in the case of data transfers to the U.S., a distinction must be made between the two following situations:

• When the recipient of the personal data (unencrypted or decipherable by that recipient) is directly subject to the surveillance and requests of U.S. intelligence services based on FISA and EO 12333: in this case, achieving the implementation of additional safeguards is particularly delicate. This is the situation faced by Microsoft in the U.S.
• When the recipient of the data is not directly subject to the surveillance established by FISA and EO 12333: in this case, the personal data is still generally subject to the surveillance program in question when in transit to the data recipient. According to the CNIL, when the data is in transit, it uses communication channels subject to the surveillance programs examined by the CJEU in the Schrems II. However, in this situation, additional encryption measures are likely to ensure, under certain conditions, an essentially equivalent level of data protection as provided for in the EU.

The CNIL recognized that the CJEU only examined the situation where an operator transfers, on its own initiative, personal data to the U.S. However, in the CNIL’s view, the reasons for the CJEU’s decision also require examining the lawfulness of a situation in which an operator processes personal data in the EU but faces the possibility of having to transfer the data following an administrative or judicial order or request from U.S. intelligence services. In that case, the CNIL considered that U.S. laws (FISA and EO 12333) also apply to personal data stored outside of the U.S.

The CNIL also considered that, despite all of the technical measures implemented by Microsoft (including data encryption), Microsoft could still be able to access the data it processes on behalf of the HDH and could be subject, in theory,  to requests from U.S. intelligence services under FISA (or even EO 12333) that would require Microsoft to transfer personal data stored and processed in the EU.  According to the CNIL, such requests are not based on an international agreement and accordingly are unlawful under Article 48 of the EU General Data Protection Regulation (“GDPR”). The CNIL concluded that health data should be hosted by companies that are not subject to U.S. law. In the CNIL’s view, this would constitute the most effective solution to avoid any risks of transfers. However, the CNIL recognized that it also may be possible to implement a contractual mechanism whereby the U.S. service provider would conclude a license agreement with the EU company. Under this agreement, the EU company would be solely in a position to perform operations upon the personal data and would benefit from the services and expertise of the U.S. company without the latter having the possibility of accessing that data.

Finally, the CNIL considered that a transition period is necessary in order to switch to another hosting provider. During this transition period, possible data transfers could be based on a derogation from the general prohibition of data transfers outside of the EU, as laid down in Article 49 of the GDPR. In particular, the transfers could be based on Article 49(1)(d) of the GDPR that allows the transfer of personal data for important reasons of public interest under EU or Member State law. According to the CNIL, if the transfers to U.S. authorities are not in the public interest, there is a manifest public interest in maintaining the continuity of the data hosting and use of such data. Such a derogation should however result from a specific and temporary regulatory provision.

Conseil d’État’s Decision

In its decision, the Conseil d'État agreed with the CNIL that it cannot be totally discounted that U.S. public authorities could request Microsoft and its Irish affiliate to access some of the data held in the HDH. However, contrary to the CNIL, the summary proceedings judge of the Conseil d'État did not consider the CJEU’s ruling in the Schrems II case to also require examination of the conditions under which personal data may be processed in the EU by U.S. companies or their affiliates as data processors (or even data controllers). According to the Conseil d’État, EU data protection law does not prohibit organizations from subcontracting any data processing activities on EU territory to a U.S. company. In addition, the summary proceedings judge found that the violation of the GDPR in this case was purely hypothetical because it presupposes that U.S. authorities are interested in accessing the health data held in the HDH and Microsoft is not in a position to reject any possible access requests. In this respect, the summary proceedings judge noted that the health data is pseudonymized before being shared within the HDH and is then encrypted by Microsoft. Lastly, the judge highlighted that, in light of the COVID-19 pandemic, there is an important public interest in allowing the continuous processing of health data as enabled by the HDH. The summary proceedings judge concluded that there is no adequate justification for suspending the data processing activities conducted by the HDH, but ordered the HDH to work with Microsoft to further strengthen privacy rights (by amending their data processing agreement), until a solution that eliminates any risk of U.S. authorities accessing personal data is implemented (such as the use of a new hosting provider as announced by the French Secretary of State for Digital, or the conclusion of a license agreement as suggested by the CNIL).

Next Steps

Following the Conseil d’État’s decision, the CNIL announced that they will provide guidance to French public authorities on the implementation of appropriate guarantees, and will ensure that use of the HDH is necessary when examining any requests for authorization of research projects using that platform.

Read the press release and full summary judgment of the Conseil d’État, and the CNIL’s press release and comments (all available in French only).