On 30 December 2020, the French DPA (“CNIL”) published recommendations on data collection in the context of vaccination against COVID-19, considering the Minister for Solidarity and Health’s decree authorizing the processing of personal data relating to the management and monitoring of vaccinations against COVID-19.
These recommendations address, among others, what data is collected, who will have access to the data, the retention period for such data, and the applicable data subject rights.
In particular, the CNIL underlines that the data of individuals vaccinated or invited to be vaccinated or vaccinated must be collected only for the purpose of the COVID-19 vaccination campaign, managing the supply of vaccines and syringes, pharmacovigilance monitoring, and carrying out research. Furthermore, the CNIL notes that once the consent to vaccination has been expressed by the concerned individuals, it will no longer be possible for them to oppose the processing of data concerning them, given the data processing meets an important objective of public interest, in particular in the context of pharmacovigilance.
The recommendations are available here (only in French).
