#2025-105French watchdog backs secure sharing of worker health data to prevent job loss
AI-generated summary for informational purposes only. Not legal advice. See the original source for the authoritative text.
This opinion supports a system that lets France’s health-insurance medical control teams share selected worker health information with workplace health services when a worker faces a risk of losing their job because of illness or injury. The exchange only happens if the worker agrees. For employers, occupational health services, and the national health insurance system, the main message is that the data flow must be tightly controlled: only authorized staff should see it, access must be logged, and confidentiality must be protected. The CNIL also backs a joint notice that explains the process and makes clear that workers can refuse or later withdraw consent without losing their rights.
AI-generated summary. May contain errors. Refer to official sources for legal decisions.
Key Changes
- Allows selected worker health data to be shared between the national health insurance medical control service and workplace health services, but only with the worker’s consent.
- Requires strict confidentiality protections, including limited access for authorized staff and logging of data access.
- Supports a common information notice so workers understand the process, can refuse, and can withdraw consent later without penalty.
Obligations
What this law requires
When transmitting worker health-related data via the secure health messaging system, controllers must ensure strict confidentiality, including granting access only to specifically authorized staff who need the data to perform their duties and maintaining traceability/logging of accesses.
The transmission of personal data between the medical control service and the SPST may only occur if the worker has given consent; without consent, the data transfer must not take place.
The service receiving consent must ensure that the worker's agreement is informed and freely given, with particular attention to the clarity and voluntariness of consent before any transmission of data.
A joint information notice must be prepared by the ministry together with CNAM and SPST and made available through CPAMs to properly inform workers about the data transfer process.
The information notice must tell workers that they can withdraw their consent at any time.