French Public Health Code
In forceI.-In accordance with 2° of Article L. 1462-1, makes the following information available on its website:
1° The identity and contact details of the data controllers of the national health data system as well as information relating to the databases that feed it;
2° The procedures for exercising the rights provided for in II and III of this article;
3° The list and characteristics of projects involving data from the national health data system, in particular those mentioned in Article R. 1461-17 ;
4° The information provided for in II of Article L. 1461-3.
The Caisse nationale de l'assurance maladie provides individual information, on paper or electronically, relating to the implementation of the national health data system, enabling the main features of this system to be brought directly to the attention of individuals. It makes this information available on its website, which links to the Plateforme des données de santé website.
The bodies responsible for the databases inform the data subjects that their data is being fed into the national health data system.
II - The rights of access and rectification are exercised under the conditions defined in Articles 15 and 16 of Regulation (EU) 2016/679 of 27 April 2016.
The right to object, provided for by Article 21 of Regulation (EU) 2016/679 of 27 April 2016 and Article 74 of Law No. 78-17 of 6 January 1978, applies to data from the processing operations mentioned in 1° of I of Article L. 1461-3. It does not apply:
1° In the context of the creation of the national health data system, to data in the main database mentioned in I of Article R. 1461-2;
2° In the context of making data available, to processing implemented by State services, establishments and organisations listed in Article R. 1461-12 as part of their permanent access.
Where their data comes from databases listed in the catalogue, data subjects may exercise a right to erasure, under the conditions set out in Article 17 of Regulation (EU) 2016/679 of 27 April 2016.
III -To exercise the rights mentioned in II, the data subject must send their request, providing proof of identity by any means, to the director of the Platform or the director of the compulsory health insurance body to which they are affiliated.
IV - Joint data controllers shall ensure that requests made by data subjects who exercise their rights in accordance with II are dealt with consistently for all data in the national health data system, regardless of which joint data controller makes them available.
They shall set up a circuit in accordance with the provisions of Article R. 1461-7 and in accordance with a procedure guaranteeing that no-one can have both the identity of individuals, in particular their registration number in the National Register for the Identification of Natural Persons, and the pseudonym provided for in I of the same article.
Within the strict limits of what is necessary for the exercise of the rights mentioned in II and in accordance with appropriate technical and organisational protection measures, the Health Data Platform or its processor is authorised to process appropriate and relevant personal data, including the registration number of individuals in the National Register for the Identification of Natural Persons. These provisions are without prejudice to the powers of the Caisse nationale de l'assurance maladie to ensure the pseudonymisation of the data of the person concerned.
