Health sectors regulatory

Full reference: Frison-Roche, M.-A., "Health Data Hub est un coup de maître du Conseil d'État", interview realized by Olivia Dufour for Actu-juridiques, Lextenso, 22nd of October 2020 Read the news of 19th of October 2020 of the Newsletter MAFR – Law, Compliance, Regulation on which relies this interview: Conditions for the legality of a platform managed by an American company hosting European health data​: French Conseil d'État decision  To go further, on the question of Compliance Law concerning Health Data Protection, read the news of 25th of August 2020: The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection 

Full reference: Frison-Roche, M.-A., Conditions for the legality of a platform managed by an American company hosting European health data​: French Conseil d'État decision, Newsletter MAFR – Law, Compliance, Regulation, 19th of October 2020 Read by freely subscribing the other news of the Newsletter MAFR – Law, Compliance, Regulation -   News Summary: In its ordinance of 13th of October 2020, Conseil national du logiciel libre (called Health Data Hub), the Conseil d'État (French Administrative Supreme Court) has determined the legal rules governing the possibility to give the management of sensitive data on a platform to a non-europeans firm, through the specific case of the decree and of the contract by which the management of the platform centralizing health data to fight against Covid-19 has been given to the Irish subsidiary of an American firm, Microsoft.  The Conseil d'État used firstly CJEU case law, especially the decision of 16th of July 2020, called Schrems 2, in the light of which it was interpreted and French Law and the contract linking GIP and The Conseil d'État concluded that it was not possible to transfer this data to United-Sates, that the contract could be only interpreted like this and that decree and contract's modifications secured this. But it observed that the risk of obtention by American public authorities was remaining.  Because public order requires the maintenance of this platform and that it does not exist for the moment other technical solution, the Conseil d'État maintained the principle of its management by Microsoft, until a European operator is found. During this, the control by the CNIL (French Data Regulator), whose the observations has been taken into consideration, will be operated.  We can retain three lessons from this great decision: There is a perfect continuum between Ex Ante and Ex Post, because by a referred, the Conseil d'État succeed in obtaining an update of the decree, a modification of the contractual clauses by Microsoft and of the words of the Minister in order to, as soon as possible, the platform is managed by an European operator. Thus, because it is Compliance Law, the relevant time of the judge is the future.  The Conseil d'État put the protection of people at the heart of its reasoning, what is compliant to the definition of Compliance Law. It succeeded to solve the dilemma: either protecting people thanks to the person to fight against the virus, or protecting people by preventing the centralization of data and their captation by American public authorities. Through a "political" decision, that is an action for the future, the Conseil found a provisional solution to protect people against the disease and against the dispossession of their data, requiring that an European solution is found.  The Conseil d'État emphasized the Court of Justice of The European Union as the alpha and omega of Compliance Law. By interpreting the contract between a GIP (Public interest Group) and an Irish subsidy of an American group only with regards to the case law of the Court of Justice of European Union, the Conseil d'Etat shows that sovereign Europe of Data can be built. And that courts are at the heart of this.  -   Read the interview given on this Ordinance Health Data Hub   To go further about the question of Compliance Law concerning health data protection, read the news of 25th of August 2020: The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection   

Full reference: Frison-Roche, M.-A., The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection, Newsletter MAFR – Law, Compliance, Regulation, 25th of August 2020  Read by freely subscribing other news of the Newsletter MAFR – Law, Compliance, Regulation   Summary of the news The "right to be forgotten" is an invention of the Court of Justice of the European Union during the case Google Spain in 2014. It implies that digital firms block the access to personal data of someone who asks it. This "right to be forgotten", which permits to impose secret to third parties has largely been generalized by GDPR in 2016. This new fundamental subjective right is a very political and European right. United-States which, on the contrary of Europe, did not experience nazism, links the "right to be forgotten" to the protection of consumer, conception which especially leads California Consumer Privacy Act adopted in 2018 to link this right to a situation of absence of necessity of this data for the firm which obtained it.  In Europe, this willingness to protect directly the person increases the scope of such a subjective right. Thus, in France and in Luxembourg, since 2020, a cancer survivor can thus ask that such an information is not accessible among his or her health data, especially for insurance companies which use them in their risk calculus to set premium amount. Netherlands will do the same in 2021 to fight against discrimination between banks' and insurances' clients.  The "monumental goal" is therefore not so much here the protection of individual freedoms as the protection of the vulnerable person, which is bye the way the keystone of a Compliance Law, concealing sometimes prohibition to circulate information (as here) and sometimes obligation to circulate information (in other cases, where the alert must be given) depending on whether vulnerable people are protected either by one or by the other.

Full reference: Thouret, T., Le pharmacien, un "opérateur crucial" pour prévenir une crise des opiacés en France, Actu-juridiques, Lextenso, 2020 Lire l'article (in French)