Free preliminary assessment
FRENES
← The journal / Data & GDPR
Data & GDPR5 min read

Data leaks from COVID-19 antigen tests and GDPR

Publication from our firm · published on October 19, 2021

The importance of GDPR compliance for healthcare professionals

In line with its control strategy for the year 2021, primarily targeting the cybersecurity of the French web and the security of health data, the CNIL is continuing its control campaign. The CNIL carried out an inspection of actors involved in actions to combat the COVID-19 pandemic and highlighted flagrant health data security violations. A further illustration of the obligation for healthcare professionals, and pharmacies, in this case, to ensure their compliance (and that of their subcontractors) with the General Data Protection Regulation.

The Company affected by the data security violation: FranceTest

The company FranceTest is the intermediary through which a very large number of pharmacists in France use to record and transmit the results of COVID-19 antigen tests in the dedicated software: SI-Dep. (Screening Information System)

This private company is thus a subcontractor of numerous pharmacies responsible for carrying out antigenic tests. Data which can be qualified as health data, within the meaning of the General Regulation for the Protection of Personal Data (Reg. (EU) 2016/679), April 27, 2016, – GDPR).

After revelations from the French press, and an anonymous report received by the Commission Nationale Informatique et Libertés (CNIL), the company admitted, in August 2021, that there was a computer flaw in its system, which made accessible some 700,000 results of antigenic tests carried out in pharmacies.

Following checks carried out by the CNIL, as a result of these revelations, it turned out that the flaw concerned a database containing the name, first name, email address, telephone number, date of birth, test result (positive or negative) and Social Security number of some 386,970 unique people.

The CNIL investigation

In accordance with the prerogatives granted to it by the Data Protection Act, the CNIL carried out checks online and in the company’s facilities in order to verify the measures taken to ensure the security of this data.

Although the CNIL found that the company had taken certain steps to address the causes of the data breach, it nevertheless noted that the FranceTest service still had significant data security vulnerabilities.

Indeed, the CNIL notes that:

  • the health data is hosted by a service provider who does not have (mandatory) HDS approval (health data hosting),
  • the authentication processes were not sufficiently robust,
  • the cryptological processes used were weak and the logging (recording of the actions of people accessing the tool) of server activities was insufficient.

As a result of its findings, the CNIL sent the company FranceTest a formal notice to take all necessary measures to guarantee the security of the health data it processes on behalf of hundreds of pharmacies, within two months following the CNIL’s decision. In addition, the CNIL sent a letter to “more than 300 pharmacies to verify their compliance with [Rgeneral data protection regulations] and the security obligation”.

Strengthened protection of personal health data

As a reminder, health data is considered “sensitive data” whose processing is prohibited in principle by the GDPR (Reg. (EU) 2016/679, April 27, 2016, art. 9.; Law no. 78-17, Jan. 6, 1978, art. 6 amended).
A series of exceptions, however, provide a basis for deviating from this ban on processing health data. Among these exceptions, which make it possible to justify the processing of personal health data, include in particular:

  • Explicit Consent of the data subject may allow, to a certain extent, an exception to the prohibition on the processing of health data;
  • Labor law, social security, social protection: for processing necessary for the purposes of carrying out the obligations and exercising the rights specific to the controller or the data subject in matters of labor law, social security and social protection;
  • Safeguarding the vital interests of the persons concerned;
  • Preventive medicine or occupational medicine, the assessment of the worker’s work capacity, medical diagnoses, health or social care, or the management of health care or social protection systems and services ;
  • The public interest when processing is“necessary for reasons of important public interest, on the basis of Union law or the law of a Member State which must be proportionate to the objective pursued, respect the essence of the right to data protection and provide for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject”

This health data is subject to specific protection by several texts including: the GDPR, the Public Health Code, and the Data Protection Act.

Among the specific obligations that apply to the processing of health data: Article L 1111-8 of the Public Health Code (CSP), largely amended by Ordinance No. 2017-27 of January 12, 2017, establishes the framework for the hosting of health data. It sets out the obligation of certification/approval of

  • “I.-Any person who hosts personal health data collected during prevention, diagnosis, care or social and medico-social monitoring activities, on behalf of natural or legal persons at the origin of the production or collection of this data or on behalf of the patient himself.

All of these obligations and the reinforced protection of this data make it essential for any health professional, who by nature processes health data, to comply.

Are you a pharmacist or healthcare professional, and would you like to comply?
Contact the LEGALPROTECH-AVOCATS firm for an audit of your structure.

Samuel DENIN, Lawyer

Sources

Article published on October 19, 2021. Its content reflects the context of its publication.

A question about your situation? Contact the firm ↗
EXPLORE FURTHER

Related reading