CNIL sets out GDPR duties for internal research by health professionals using patient care data

France’s data protection authority, the CNIL, has published guidance on “internal research” carried out by health professionals. A project qualifies only if it meets three cumulative conditions. It must use data collected during patients’ individual care, be carried out by the staff providing that care, and be for those staff’s exclusive use.

Such projects need no prior formalities with the CNIL. They still fall under the GDPR’s general duties, including entries in the record of processing, a possible data protection impact assessment and informing patients under Articles 12 to 14. The CNIL recommends layered notices and allows collective information only where individual notice would demand disproportionate effort. The right to object under Article 21 applies.

Projects that miss any criterion need a declaration of conformity with a reference framework or prior CNIL authorisation. Results may be used to inform the public and the scientific community, but access to participants’ health data must stay restricted to the care team unless the data has been anonymised.