France: CNIL advises on draft implementing decrees for COVID-19 health pass

The French data protection authority (CNIL) published, on 9 August 2021, its opinion on two draft implementing decrees regarding the COVID-19 health passes, as requested by the Government of France, notably Decree No. 2021-1059 of 7 August 2021 amending Decree No.2021-699 of 1 June 2021 prescribing General Necessary Measures for Management of Exiting the Health Crisis ('the Health Pass Decree') and Decree No. 2021-1060 of 7 August 2021 amending Decree 2021-901 of 6 July 2021 in relation to the Automatic Processing of Personal Data ('the Certificate Converter Decree'). In particular, the decrees seek to extend the use of the health pass, the retention period for information contained in the centralised information system for COVID-19 results ('SI-DEP'), and to allow local health authorities to access information regarding the vaccination status of their employees where vaccination is mandatory.

Among other things, CNIL warned that the extension of the use of health passes to further public places, such as restaurants, drinking establishments, and long distance train journeys, may lead to automatic processing of health data on a large scale and thus the normalisation of use of such systems which threaten the right to privacy. However, CNIL noted that the use of such systems may be used exceptionally in the context of the pandemic where they are strictly necessary and prevent use of more restrictive measures, such as another lockdown.

You can read the press release here (IT) www.ladysilvia.com...via/29126/health/0/ (FR) www.ladysilvia.com...via/29127/health/0/ , the opinion here www.legifrance.gou...ORFTEXT000043915894 , the Health Pass Decree here www.legifrance.gou...ORFTEXT000043915443, and the Certificate Converter Decree here www.legifrance.gou...ORFTEXT000043915499, all only available in French and Italian.

Source by Dataguidance