On August 20, the CNIL provided guidance on the measures to be taken by health researchers who modify the initial purposes for data processing (source document in French). A significant change in the purposes for data processing may require prior authorization from the CNIL in certain circumstances (such as research involving the human body). Health research is one of the few exceptions where the CNIL still requires authorization prior to implementation of data processing.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.