The Council of State has approved a project to transfer health data of millions of French people to the French health data platform for research, despite it being hosted by Microsoft.
In a decision made public on Friday, March 20, the Council of State ruled that the approval given to the project by the CNIL was in line with European data legislation (GDPR). This decision went against two associations and a cloud computing company who raised concerns about the risk of government access to the data under US extraterritorial laws.
The contested project, Darwin, involves transferring health data held by the Health Insurance on 10 million people. The data will be used for studies coordinated by the European Medicines Agency on “the incidence and prevalence of medication use in the general population”.
According to a summary of the decision published by the Council of State, “the risk that American authorities, based on their own legislation, may request Microsoft to access personal health data cannot be completely ruled out”. However, the health data platform provided guarantees to ensure the security of the data, including pseudonymisation and limiting their retention to three years.
The health data will be stored in “data centers located in France” and there will be no transfer of data to the United States, as noted in the judgment. The decision of the health data platform to use Microsoft’s services has faced significant opposition from experts and data specialists, regarding digital sovereignty and security.
In February, the government announced that the health data platform would seek a new operator to replace Microsoft. This operator must not be subject to non-European legislation, ruling out non-European operators. The government aims to complete the transfer of the platform by the end of 2026.
