Healthcare authorization requests: the CNIL's 2024 review

In 2024, the handling of healthcare authorization requests reached a significant turning point, with a growing number of applications recorded by the Commission Nationale de l'Informatique et des Libertés (CNIL). This trend, with 619 files submitted, highlights not only the growing importance of health data processing but also the evolution of practices in terms of data compliance and security. It is essential to explore how these changes affect the healthcare sector, particularly with regard to research projects and review times, which are proving increasingly streamlined. Indeed, the commitment of an agency such as the CNIL aims to ensure that data practices align with strict data protection standards while facilitating innovation in the healthcare field. Let us continue this analysis to discover the key figures relating to these authorization requests, the improvements observed in the quality of files, and the new tools offered by the CNIL to assist applicants in their procedures.

If you would like to engage a lawyer specializing in personal data law, contact me!

What are the statistics on the authorization requests received by the CNIL in 2024?

In 2024, the CNIL recorded a significant increase in the number of authorization requests relating to health data processing. In total, 619 requests were registered, representing a 20% increase compared to 2023. This trend highlights the growing interest of healthcare sector players in bringing their projects into compliance with legal and regulatory requirements.

On the other hand, the breakdown of requests reveals interesting insights. Of these 619 requests, 472 were linked to research projects, while 147 concerned non-research processing. This shows that the majority of applicants focus on sought-after innovative initiatives while complying with health data regulations.

The CNIL's ability to grant authorizations was also reflected in the results, with 397 authorizations granted, i.e. an acceptance rate of 65%. This favorable situation indicates a willingness to encourage projects that comply with data security standards and the requirements imposed by legislation.

Moreover, it is important to note that 174 files were closed without further action, although a 7% decrease compared to the previous year was observed. This reflects an improvement in the quality of the files submitted, suggesting that applicants are increasingly aware of the required criteria. This has undoubtedly helped to reduce review times, illustrating the impact of this positive trend on the request examination process.

While these figures demonstrate the evolution of practices in data management, let us reflect on the evolution of file quality and review times. How significant were these improvements, and what challenges does this raise for future health data processing?

Let's discuss your needs for 15 minutes!

How did file quality and review times evolve in 2024?

In 2024, the quality of the files submitted to the CNIL for authorization requests relating to health data processing improved noticeably. This phenomenon is largely attributable to greater awareness among applicants of compliance requirements, thereby producing more complete and better-structured files. Many healthcare players, anticipating the various criteria required by legislation, invested time and resources to ensure that their projects complied with the CNIL's recommendations.

This increase in quality had a direct impact on the review times for requests. Indeed, with more complete files, the CNIL observed a significant reduction in the back-and-forth needed to request additional information. As a result, review times were streamlined, allowing the Commission to process a greater number of requests within a reasonable timeframe. This shows that applicants' efforts to understand the legal requirements translate into a more efficient examination process.

In addition, the CNIL implemented various initiatives to support applicants in preparing their files. Webinars and practical guides were developed to clearly explain the Commission's expectations, in order to ensure a level of data security consistent with the high standards required. These awareness-raising measures facilitated the development of robust research projects, complying with both data protection laws, such as Article 6 of the General Data Protection Regulation (GDPR), and the need for innovation in the healthcare field.

Feedback from professionals in the sector indicates a growing desire to collaborate with the CNIL in order to continuously improve the quality of authorization requests. This proactive collaboration could also play a key role in the emergence of new projects within the healthcare sector, paving the way for better integration of digital solutions while ensuring data security. We can now consider the tools and support made available by the CNIL to assist with these procedures and continue improving practices in relation to authorization requests.

I want reliable legal documents!

What tools and support does the CNIL offer to improve authorization requests?

The CNIL is actively committed to supporting healthcare sector players in their authorization request procedures, by providing them with a range of tools and resources designed to optimize the quality of the files submitted. In 2024, this commitment was reinforced by the publication of several practical fact sheets, which detail the specific criteria to be met in order to obtain authorization for health data processing. These documents aim to clarify the Commission's expectations and to provide a solid frame of reference for applicants.

In addition, the CNIL organized webinars to inform professionals about best practices in data processing. These training sessions emphasize the importance of data minimization, the prevention of the use of "prohibited purposes", and compliance with the new security standards. Through these efforts, the CNIL helps to improve file preparation and to facilitate the understanding of compliance challenges, particularly with regard to data security measures such as pseudonymization and anonymization.

The tools offered are not limited to general information. The CNIL is also engaged in a process of continuous improvement, with the development of a new authorization request form, scheduled for mid-2025. This new tool should further facilitate the submission of compliant files, while reducing the review times already observed. In 2024, the average review time for research projects was 65 days, while that for "non-research" requests was 49 days, a clear sign of the increasing efficiency being implemented.

By analyzing the use cases submitted to it, the CNIL also develops a doctrine that it publishes on its website, thereby enriching professionals' knowledge of the regulation of health data. By fostering constructive dialogue, the CNIL intends to play a key role in ensuring compliance while supporting innovation in the healthcare sector. With these tools and this support, it is essential to ask how this trend will continue to influence data processing practices in the years to come.

To find out more, please consult the CNIL's article: https://www.cnil.fr/fr/demandes-autorisation-sante-bilan-2024.