On the conformity of the law creating universal medical coverage with the Constitution

The Conseil Constitutionnel…

43. Considering that article 36 of the law modifies article L. 161-31 and L. 162-1-6 of the Code of Social Security on the contents and use of an “individual electronic interdepartmental card” as well as its issuance to all those insured against illness;

44. Considering that the applicants criticise this provision as incompatible with respect for the citizen’s private life, on the ground that the system for transmitting data relative to the health of the cardholder is not foolproof but is capable of being hacked into;

45. Considering that article 2 of the Declaration of the Rights of Man and Citizen provides that “The aim of all political associations is to maintain the natural and inalienable rights of man. These rights are the right to liberty, property , security and the right to resist oppression”, and that in this article “liberty” implies respect for private life;

46. Considering that according to article L. 161-31 (1) of the Code of Social Security the individual’s electronic card “must be able to record an explicit statement of the consent of the holder or his statutory representative to the inclusion of the such matters as are needed not only for medical treatment but also for post-therapeutic care”; that article L. 1161-31(2) provides that “In the interest of the patient’s health, the card includes a segment on health … which must include no information other than that needed for urgent treatment and details facilitating further treatment and consequential care”; that by virtue of article L. 162-1-6(1) of the Code of Social Security such information may not be entered on the card except with the consent of the cardholder or, in the case of a minor or an adult without capacity , his statutory representative; that such persons may “make access to one part of the information included in the health segment depend on a secret code which they themselves have devised”; that they may access the health segment through a licensed health-care provider as intermediary ; that they have the right to correct the information, to have certain observations suppressed, and to prevent the inclusion of certain matters when the data on the health segment are being modified; that furthermore a decree of the Conseil d’Etat issued after public notice and with reasons given by the Conseil national de l’Ordre des médecins and the Commission nationale de l’informatique et des libertés may lay down what kind of information may be included in the health segment, how to identify the professionals who enter the information on the card, and the conditions under which licensed professionals may access, enter or delete information, depending on its type; that in the event of breach of the rules restricting the communication of data on the health segment and the rules regarding the alteration of such information, the sanctions laid down in part VI of article L. 162-1-6 of the Code of Social Security apply, and the criminal sanctions laid down in those articles apply notwithstanding section V of Chapter II of the second book of the Criminal Code entitled “Invasion of the rights relating to files and computer data”; and that finally the legislator had no intention of derogating from the provisions of article 21 of the above-mentioned Law of 6 January 1978 concerning the powers of supervision and control vested in the Commission nationale de l’informatique et des libertés.

47. Considering that all these safeguards which attach to the implementation of the provisions of article 36 of the Law, along with the features ensuring the security of the system, provide a sufficient guarantees of the respect due to privacy

As to article 41:

48. Considering that this article inserts into the above-mentioned Law of 6 January 1978 a Chapter V (ter) entitled “Processing of personal health data for the purposes of evaluating or analysing therapeutic and prophylactic health care” containing articles 40-11 to 40-15, which define how health data may be communicated, even to those outside the administration, so as to make it possible to check and analyse the success of health care and prevention; article 40-12 lay s down that in principle “the data held in the information systems covered by article L. 710-6 of the Code of Public Health, in the medical dossiers established by professional health care providers and the files held by medical insurers can only be released for the statistical evaluation and analysis of the practice and operation of health care if the data are consolidated or, if given in relation to individual patients, are provided in such a way as to prevent the identification of the patient”; that derogation from this rule can be made only on the authorisation of the Commission nationale de l’informatique et des libertés, and even in this case the data may not include the name or forename of the persons involved nor their national identification number; that articles 40-13 to 40-15 circumscribe the powers of the Commission nationale de l’informatique et des libertés, stating that in particular it must establish “the need to have recourse to personal data and the appropriateness of the processing in relation to its declared purpose of evaluation and analysis of practices and operations in the area of health care”; that, should the party making the request fail to provide sufficient evidence of the need to obtain certain information processed as above, the Commission may “prohibit the disclosure of such information by the body which controls it and lay down that only such limited data may be processed”; that it must give its response within a period of two months after receipt of the request, extensible once, silence being counted as a refusal;

49. Considering that it is objected that in requiring an “appropriate opinion of the Commission nationale de l’informatique et des libertés” before anonymous statistical information may be disclosed article 41 is incompatible with the freedom of communication laid down by article 11 of the Declaration of the Rights of Man and Citizen of 1789; and that furthermore this formality is “ an inadequate guarantee of the anonymity of the data”.

50. Considering that, first of all, it follows from the terms of the law that provided that the health data are anonymised, directly or indirectly, they may be communicated quite freely, so that the complaint is factually inaccurate in stating that the disclosure of anonymous data requires the authorisation of the Commission nationale de l’informatique et des libertés;

51 Considering, secondly, that it was for the legislator to devise a procedure which safeguards respect for people’s private life when disclosure is sought of health data which permit the identification of the subject; that in requiring authorisation by the Commission nationale de l’informatique et des libertés for any such disclosure the legislator has indeed devised methods which respect the private life of the subjects in conformity with article 11 of the Declaration of the Rights of Man and Citizen;

Decides:

Art. 1: …

Art. 2: [Subject to the qualifications contained in this decision] articles …..36 and 41 are declared to be in conformity with the Constitution.

Back to top

This page last updated Thursday, 15-Dec-2005 09:05:51 CST. Copyright 2007. All rights reserved.