On 24 March 2021, the French data protection authority (“CNIL”) announced the issuance of its new standard on the processing of personal data related to providing social welfare or medico-welfare support to vulnerable individuals.
In particular, the standard addresses the data protection requirements applicable to the social welfare or medico-welfare sectors, such as support, management, as well as payment of statutory or optional social welfare or medico-welfare. Furthermore, the standard covers the suitable legal bases in this context, types of personal data likely to be collected, retention periods, recipients of relevant personal data, and information to be provided to data subjects regarding their rights.
Moreover, the CNIL published FAQs on the said standard, which clarify, among other things, that the data controller must collect only the data necessary for providing support and that, where valid consent is required from persons without discernment, their legal representative’s consent must be sought.
The full press release is available here, the standard is available here, and the FAQs are available here (all only in French).
