The president of the National Commission for Information Technology and Liberties (CNIL), Marie-Laure Denis, was interviewed by the deputies of the National Assembly, Tuesday, May 5, as part of the parliamentary debate related to the bill aimed at to extend until July 24 the state of health emergency in France, in order to fight the Covid-19 epidemic.
The president of the CNIL was invited to speak on the French personal data storage devices mentioned in this bill, intended to help identify the sick and prevent them from infecting other people.
These devices, listed in Article 6, were presented by the Minister of Health, Olivier Veran, on Saturday May 2. He then explained that the government wanted the establishment of a new ” information system ” for “List sick people” and “Contacts of sick people, so as to identify any person likely to transmit the virus in the population”, in order to “Allow care” or “Quarantine and isolation measures when necessary”.
Two files, three levels of “tracing”
Even if the government must submit to the CNIL in the coming days its draft decree detailing the data that will be concretely collected and the files that will be created as part of this new ” information system “, Olivier Véran has already publicly given several main principles of its operation.
A new national file must therefore be created to identify all people tested positive for SARS-CoV-2 by medical biology laboratories: this will be the file Sidep. Another database, which must be named Contact Covid, is planned to identify “The contact details of the people to contact” when a sick person is identified.
These medical databases will be fed by several types of censuses carried out by health professionals and identified teams, according to what Olivier Veran said. He also specified that this set will be “Independent of StopCovid “, the smartphone tracking app being developed and which the government hopes will be released in June.
The Minister of Health spoke in detail:
- A tracing level 1, who will be “Exercised by doctors, primary healthcare professionals in town as well as in hospital, to define the first circle cases, potential contacts of patients ”. In an interview with Echoes published on 1er May, the Director General of Medicare stated that doctors will have access to this, from May 11, on the Ameli Pro platform, to a form to fill out: “If the patient tests positive, the doctor will have to write his identity and fill in as many names of people who have come into contact with him, going back up to forty-eight hours before the onset of symptoms. “
- The tracing level 2, who will be “Organized by Medicare” and its thousands of employees who will constitute “Health brigades”, the creation of which was announced by Edouard Philippe on April 28 before the Assembly. This investigative work will aim “To enrich the list of potential contacts beyond this first circle, to verify that no potentially sick person was able to escape the first tracing and give instructions to those interested ”, said Olivier Veran on Saturday.
- The tracing level 3, finally, will be the one who is “Organized, as it has been since the start of the epidemic, by regional health agencies [ARS]. It's about going to identify chains of contamination, chains of transmission, what we used to call clusters “, said the Minister of Health.
The deletion period in question
This stack of collected data, that the new ” information system “ wanted must allow to articulate in the fight against the coronavirus, will be accompanied by an opinion of the CNIL ” released “, finally promised Olivier Veran on May 2. It is in this context that Marie-Laure Denis, president of the institution responsible for protecting the privacy of French people, told deputies on Tuesday that the CNIL will be “Particularly attentive to the duration of the data that will be kept, and to the relevance” of these.
As it stands, Article 6 of the bill extending the state of health emergency provides that the new ” information system “ should be operational for “The entire duration of the epidemic” or ” later (…) one year from the publication of the law “.
During her hearing, Marie-Laure Denis suggested that some of this survey data linked to this system be erased, or made inaccessible more quickly than this one-year period mentioned. “Some data related to completed surveys” around an infected patient “Should be phased out fairly soon, well before the end of the epidemic”, recommended the president of the CNIL. The data relating to the identification of “contact cases” (that is to say individuals crossed by an infected person), or certain responses from infected people, do not necessarily need to be kept for as long, according to she.
She indicated that her institution will also ask to see the questionnaire that the health brigades will submit to the contaminated people. “It will be necessary to give very clear instructions to the investigators on what they can ask for and then collect” with people carrying the coronavirus, and “About what they don't have to know”, warned Mme Denis. The CNIL will “Particularly careful to avoid as far as possible that (…) the investigators have free fields where they would put unnecessary information “, she detailed.
The president of the CNIL will also work “Checks from the first weeks of the device” to verify compliance with the provisions governing the work of the health brigades, she warned. She also estimated that it would be “Justified” that the government consult the CNIL if it decides to adopt future ordinances on this subject.
This last point had notably worried the senator Bruno Retailleau, president of the group The Republicans in the Senate, who had indicated in the press, Sunday, May 3, that he deplored certain shortcomings in article 6: the impossibility of legislating by ordinance on the subject ; the creation of a specific control body; and the possibility of being able to refuse to be entered in the files for third parties who have potentially been contaminated by others.
Our selection of articles on the coronavirus