Selecting a language will automatically trigger the translation of the page content.

Vaccination against Covid-19: what guarantees regarding the collection of personal data?

Publié le 09 août 2021 - Legal and Administrative Information Directorate (Prime Minister)

Crédits : © sebra - AdobeStock

Computer keyboard medicine

A decree issued on 26 December 2020 in Official Journal authorises the Ministry of Solidarity and Health and the National Health Insurance Fund to set up a processing of personal data « SI Vaccine Covid » for the implementation and monitoring of vaccination campaigns against Covid-19. Its control is ensured by the National Commission of Informatics and Freedoms (CNIL). What are the modalities? Explanations with

Managed by the National Health Insurance Fund (CNAM) and the General Directorate of Health, « SI Vaccine Covid » collects information relevant to the organisation of the vaccination campaign, the monitoring and supply of vaccines and consumables (syringes...), as well as to the conduct of research and pharmacovigilance monitoring.

This device allows the identification of individuals eligible for vaccination, the ability to send them vaccination vouchers, the ability to monitor any adverse effects caused by vaccination, and the ability to contact individuals in the event of a new risk.

In its opinions of 10 December 2020 and 19 January 2021, the CNIL issued recommendations aimed at ensuring compliance with data protection regulations and recalled that it would be vigilant regarding the conditions of its implementation.

The collected data

The information collected shall include:

  • identity and contact information;
  • the Social Security Number (NIR);
  • the date of injection;
  • the vaccine chosen;
  • the batch number;
  • health data such as the eligibility criteria for vaccination determined by the Ministry of Health.

Data on health professionals and the persons under their responsibility are also collected.

Information of the persons concerned

Persons who meet the eligibility criteria that can be identified through the databases of the managers of the various compulsory health insurance schemes shall be given a vaccination certificate accompanied by information that meets the requirements of General Data Protection Regulation (GDPR) .

Persons who do not meet the criteria for receiving this voucher may express their wish to be vaccinated to their attending physician who will provide information about them in the device « SI Vaccine Covid ».

During the pre-vaccination consultation, individuals shall receive new individual information concerning the processing of their personal data.

The rights of the persons concerned

Persons may exercise their rights of access, rectification and limitation with the director of their home health insurance organisation (for example, the director of the primary health insurance fund of their place of residence through the insured space on the site ).

They may oppose the processing of their data until their consent to vaccination is expressed: the right of objection applies to the processing of health data prior to vaccination for the sending of vaccination certificates.

Second, they can no longer oppose the processing of their data. Once vaccination has been carried out, data processing meets a public interest objective, particularly in the context of pharmacovigilance.

However, it is possible to object at any time to the transmission of pseudonymized data (without the name, first name, social security number, contact details) to the health data platform and to the CNAM. In this case, individuals should approach the director of their home health insurance organisation.

Access to data

In its opinion, the Commission recalled that this data is protected by medical confidentiality and should only be processed by authorised persons subject to professional secrecy.

Some of this data is passed on to health care professionals conducting pre-consultation and vaccination. The doctor treating the vaccinated person may also have access to it, subject to the person's consent.

Other public bodies such as the CNAM or the National Agency for the Safety of Medicines and Health Products (ANSM) have access to certain data in order to fulfil their missions.

The pseudonymized data subject to specific treatment is accessible by some staff of the National Public Health Agency (ANSP) and the Regional Health Agencies (ARS) in order to monitor vaccination coverage and organise the vaccination campaign.

These data may also be shared with the Research, Studies, Evaluation and Statistics Directorate (REESS) of the Ministry of Health to compile statistics.

The pseudonymized data are also transmitted to the Health Data Hub and the CNAM for the purpose of health emergency management and to improve knowledge about the virus.

The CNIL requested that subcontractors and information systems with which « SI Vaccine Covid » shall be made public on the website of the Ministry of Health.

The length of data retention

Data will be stored in « SI Vaccine Covid » for a period of 10 years, with the exception of those necessary for the care of vaccinated persons in case of identification of new risks which will be kept by the Digital Directorate of the Ministries of Social Affairs (DNUM) for 30 years.

  FYI : This device is not intended to be extended to vaccinations other than those against Covid-19.


Découvrir la collection Doc en poche