The government would be forced to go through a legislative measure if it wanted to use a mandatory application to track the movements or contacts of citizens, according to the president of the CNIL (National Commission for Data Protection) Marie-Laure Denis .
Question: Faced with coronavirus, several countries have set up systems for the use of personal data, including Singapore where an app warns its user if he has met an infected person in the last two weeks. Is it possible in France?
Answer: The texts which protect personal data do not preclude the implementation of individual digital monitoring solutions for the protection of public health, but they impose the provision of adapted guarantees which are all the stronger as technologies are used. intrusive.
In general, applications that rely on Bluetooth data, which are encrypted directly on the phone under the control of its user, provide more guarantees than those that rely on continuous geolocation tracking (GPS) of people.
In any case, for the college of the Cnil, in addition to the essential question of the provisional nature of the use of this type of device, it is also important that it is based on voluntary service, that is to say on an informed and free choice, without consequence for the person in case of refusal.
Question: Does the government have the possibility of imposing this type of app, or other app aimed at enforcing respect for containment?
Answer: In France, the public authorities have to date ruled out the possibility of resorting to a compulsory scheme.
If it were to go otherwise, it would be necessary to adopt a legislative text to implement these devices which should in any case demonstrate their necessity to respond to the health crisis as well as their proportionality by respecting the principles of protection of personal data: the minimization of the data collected, the purposes which must be explained and precise, a provisional nature, etc.
Question: Doctors and researchers are demanding access to health data held, for example, by hospitals to research the spread of the virus, its various symptoms, its morbidity. Doesn’t data protection legislation delay data flow and research programs?
Answer: The legislation allows the establishment of research programs and several projects or studies have already been launched.
The Cnil has also published a press release indicating the procedure to be followed in order to rapidly implement research projects relating to the Covid-19.
The majority of projects can be implemented without authorization as long as they comply with one of the reference methodologies. It then suffices to make a simple declaration to the CNIL.
For those projects that require authorization, for example studies for which patients cannot be informed individually of the use made of their data, we have published a dedicated email address to pre-process requests. Once the files are complete, authorizations can be granted quickly, sometimes even within a few hours
The Cnil has already issued around ten authorizations (…) since the start of the crisis to actors like the AP / HP, Inserm, the Pasteur Institute, the Lille University Hospital …
These studies aim, for example, to test treatments, to study the mortality factors of elderly patients, or even to analyze the evolution of severe forms of the infection.
Question: Has the Cnil looked at aggregated and anonymized data on population movements, provided by Orange and SFR to research organizations such as Inserm and Inria?
Answer: These solutions were implemented by Orange and SFR a few years ago, so well before the crisis, after discussions with the Cnil. Both operators provide data that is sufficiently aggregated to be anonymized. The Cnil had then ensured that there was no risk of re-identification of people.
(Interview by Laurent BARTHELEMY)
lby / ak / or