The CNIL (French Data Privacy Authority) just published its new Guidelines on the processing of health data collected from patients

The CNIL (French Data Privacy Authority) just published on the 16th of Nov. its new Guidelines on the processing of health data collected from patients treated with pharma products authorized in France through the so-called “Early Access” and “Compassionate Use” special regulatory regimes. 

Context: 

Early Access and Compassionate Use Regulatory Licenses generally require that pharma companies conduct a Protocol to monitor the use of the products authorized under such Regulatory Licenses and collect health data regarding the safety and efficacy of the products, the real conditions of their use, as well as the characteristics of the patients benefiting from such products. 

In the normal way round, the collection and processing of personal health data must be expressly pre-approved by the CNIL.

With these new Guidelines, the CNIL brings flexibility:

By way of derogation, pharma companies can launch the Early Access or Compassionate Use Protocols without applying for the CNIL pre-approval, but to the extent that they first declare that the related processing of data health complies with the security standards set forth by such Guidelines. 

This process is inspired by the precedent simplified procedures adopted by the CNIL with the so-called “MR” (Methodologies of Reference), under which Sponsors / Data Controllers can self-certify that the patients’ data processing in the conduct of clinical trials, other clinical studies, or PV surveys, is compliant with the security and quality requirements set forth by the CNIL, without applying for the pre-approval of the latter. 

The guidelines are available (in French) here.