This page has been automatically translated. Please refer to the page in French if needed.
Public health
COVID-19 vaccination: what guarantees regarding the collection of personal data?
Publié le null - Directorate for Legal and Administrative Information (Prime Minister)
A decree published on December 26, 2020 in Official Journal authorizes the Ministry of Solidarity and Health and the National Health Insurance Fund to set up a processing of personal data known as for the implementation and monitoring of COVID-19 vaccination campaigns. Its control is ensured by the National Commission of Informatics and Freedoms (CNIL). What are the modalities? Explanations with Service-Public.fr.
Managed by the National Health Insurance Fund (CNAM) and the General Directorate of Health, the treatment collects information useful for the organization of the vaccination campaign, the monitoring and supply of vaccines and consumables (syringes, etc.), as well as for carrying out research and pharmacovigilance monitoring.
This device makes it possible to identify persons eligible for vaccination, to send them vaccination vouchers, to monitor any adverse effects caused by vaccination and to contact persons in the event of the appearance of a new risk.
In its opinions of 10 December 2020 and 19 January 2021, the CNIL issued recommendations to ensure compliance with data protection regulations and recalled that it would be vigilant as to the conditions for its implementation.
The data collected
The information collected includes:
- identity and contact details;
- Social Security Number (NIR);
- the date of injection;
- the vaccine chosen;
- the lot number;
- health data such as vaccination eligibility criteria determined by the Ministry of Health.
Data are also collected on healthcare professionals and their caregivers.
Information for the persons concerned
Persons meeting the eligibility criteria identifiable via the databases of the managers of the various compulsory health insurance schemes receive a vaccination certificate accompanied by information in accordance with the requirements of the General Data Protection Regulation (GDPR).
Persons meeting the criteria who would not have received this voucher can express their wish to be vaccinated with their treating doctor who will fill in the information about them in the device .
At the pre-vaccination consultation, individuals are provided with new individual information regarding the processing of their personal data.
The rights of data subjects
Individuals can exercise their rights of access, rectification and limitation with the director of their home health insurance organization (for example, the director of the Primary Health Insurance Fund of their place of residence via the insured space on the site ameli.fr).
They can object to the processing of their data until the expression of their consent to vaccination: the right of objection applies to the processing of health data carried out before vaccination for the sending of vaccination vouchers.
Secondly, it is no longer possible for them to object to the processing of their data. Once vaccination has been carried out, the processing of data meets an objective in the public interest, in particular in the context of pharmacovigilance.
However, it is possible to object at any time to the pseudonymized data (without surname, first name, social security number, contact details) being transmitted to the health data platform and to the CNAM. In such cases, people should approach the head of their home health insurance agency.
Access to data
In its opinion, the Commission recalled that these data are protected by medical confidentiality and should only be processed by authorized persons subject to professional secrecy.
Some of these data are transmitted to the healthcare professionals carrying out the pre-consultation and vaccination. The doctor treating the vaccinated person may also have access to them, subject to the consent of the vaccinated person.
Other public bodies such as the CNAM or the National Agency for the Safety of Medicines and Health Products (ANSM) have access to certain data in order to carry out their missions.
Pseudonymized data subject to specific treatment are accessible by certain personnel of the National Public Health Agency (ANSP) and the Regional Health Agencies (ARS) in order to monitor vaccination coverage and organize the vaccination campaign.
These data may also be provided to the Research, Studies, Evaluation and Statistics Directorate (DREES) of the Ministry of Health for statistical purposes.
The pseudonymized data is also transmitted to the Health Data Hub and the CNAM for the purpose of managing the health emergency and improving knowledge about the virus.
The CNIL requested that subcontractors and information systems with which is put in touch are made public on the website of the Ministry of Health.
How long data is kept
The data will be stored in for a period of 10 years, with the exception of those necessary to care for vaccinated persons in the event of identification of new risks, which will be kept by the Digital Directorate of the Ministries responsible for Social Affairs (DNUM) for 30 years.
FYI
This scheme is not intended to be extended to vaccinations other than COVID-19.
Additional topics
Service-Public.fr
National Commission for Informatics and Freedoms (Cnil)
National Commission for Informatics and Freedoms (Cnil)
Agenda
Calendrier scolaire
Du 6 avr. au 12 mai 2024
Publié le 15 mars 2024
Retraite
Du 23 mars au 29 mars 2024
Publié le 29 février 2024
Expulsions locatives
Jusqu'au 31 mars 2024
Publié le 18 octobre 2023