Were there any security breaches which led to the leak of medical data affecting nearly 500,000 people in France?
It is to establish this that the National Commission for Information Technology and Freedoms, police officer for the protection of personal data, is launching a series of checks on Wednesday.
If the extent of the leak was verified, Louis Dutheillet de Lamothe, secretary general of the CNIL, believes that the case would present "a particular gravity" in view of the number of victims and the sensitivity of the medical information disseminated.
However, the Commission was not notified on Wednesday of such a data breach by the responsible company (s), although the European data protection regulation requires this report within 72 hours.
"If there is a high risk for the rights and freedoms of natural persons, companies must also notify individually" the victims of the leak, specifies Louis Dutheillet de Lamothe.
The GDPR provides for penalties of up to 4% of turnover for this type of incident.
The "origin" of the identified leak
At the same time, the National Information Systems Security Agency (Anssi) claims to have identified the "origin" of the health data leak, and to have reported it to the Ministry of Solidarity and Health in November 2020. “The necessary recommendations were given by Anssi to deal with the incident,” she added without giving any additional details.
READ ALSO> Vaccinations file: the data is protected by medical confidentiality, recalls the CNIL
Tuesday evening, AFP observed that a file comprising 491,840 names, associated with contact details (postal address, telephone, e-mail) and a social security registration number, was in circulation on the Internet.
These names are sometimes accompanied by indications on the blood group, the attending physician or the mutual, or comments on the state of health (including a possible pregnancy), drug treatments or pathologies (in particular HIV).
Morning essentials newsletter
A tour of the news to start the day
Subscribe to the newsletterAll newsletters
According to Checknews, the verification service of the daily Liberation, which investigated the subject, the data would come from about thirty medical biology laboratories, located mainly in the north-western quarter of France.