The French data protection authority reminds health establishments that internal research carried out by medical staff must comply with strict data protection rules. Personal health data used for research must be processed lawfully, with a clear legal basis, and appropriate safeguards such as anonymisation or pseudonymisation wherever possible.
Organizations must inform data subjects, maintain a register of processing activities, and ensure that any data sharing respects the principles of purpose limitation and data minimisation. A Data Protection Impact Assessment is required when the processing poses a high risk to individuals, and a designated Data Protection Officer must oversee compliance.
Source: RSS – Actualités CNIL