French Health Data Hub Cleared by Top Court, GDPR Concerns Remain
France’s highest administrative court, the Council of State, has upheld a decision allowing the Health Data Hub (HDH) to process health data on Microsoft Azure, as part of the European DARWIN EU program. The ruling, delivered on Monday, March 23, 2026, addresses concerns raised by associations and digital rights groups regarding potential data transfers to the United States and compliance with the General Data Protection Regulation (GDPR).
Darwin EU and the Health Data Hub
The Darwin EU program, led by the European Medicines Agency, aims to leverage data to improve understanding of the use, safety, and effectiveness of medicines and vaccines. The Health Data Hub is a key component of this initiative, authorized by the CNIL (French data protection authority) to process personal health data from a sample of the French population for a period of three years. The project involves data from approximately 10 million individuals held by Health Insurance [2].
Council of State Ruling: Data Hosting vs. Data Transfer
The Council of State clarified that the CNIL’s authorization specifically pertains to the processing of health data hosted within data centers located in France, and does not authorize the transfer of this data to the United States [1]. The court acknowledged the possibility that U.S. Authorities could, under their own legislation, request access to data held by Microsoft. However, it stipulated that any data potentially transferred would relate to platform users, not the individuals included in the research studies, and would be subject to GDPR-compliant contractual clauses.
Guarantees and Safeguards
The Council of State emphasized that the authorization includes safeguards to protect data security, including pseudonymization and a limited data retention period of three years [3]. The CNIL was found not to have erred in its assessment.
Digital Sovereignty Concerns and Future Plans
Despite the legal clearance, concerns regarding digital sovereignty and health data protection persist. The government has announced plans to seek a latest operator not subject to non-European legislation and aims to transition to a sovereign platform later this year, initially through a call for tenders, now planned to be awarded via the Union of Public Purchasing Groups (UGAP) [1].
Cloud Act and US Access to Data
Microsoft France has acknowledged that it is legally obligated to comply with the U.S. Cloud Act, which allows American authorities to demand access to data held by companies under U.S. Jurisdiction, even if stored outside the United States [1]. While Microsoft publishes transparency reports detailing government requests and legal challenges, the potential for U.S. Access remains a point of contention.
Key Takeaways
- The Council of State validated the CNIL’s authorization for the Health Data Hub to process health data on Microsoft Azure.
- The ruling clarifies that the authorization covers data processing within France, not data transfer to the U.S.
- Safeguards such as pseudonymization and limited data retention are in place.
- Concerns about digital sovereignty and potential U.S. Access to data under the Cloud Act remain.
- The French government is pursuing a transition to a sovereign data platform.
Worth a look