What happened
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA Operations France and Kalixia to use automated processing of health data from ESND and PMSI.
Why it matters for trust and compliance
- Its status is announced. It is not law yet. Track it, but do not treat it as an obligation.
- The agenda signals upcoming CNIL scrutiny of new automated data processing initiatives affecting law‑enforcement and health research.
- It relates to GDPR. The regulations library explains what that law requires.
Who is affected
healthcare government technology controller processor Randomized clinical trials (RCTs) IQVIA Operations France Kalixia direction générale des Finances publiques
Recommended actions
- Check that privacy notices describe the practices this addresses.
- Confirm access, correction, deletion and opt-out requests are handled within the required time.
- Revisit retention schedules and data minimisation for the data involved.
- Inventory AI or automated decision systems in scope and their assessments.
- Confirm handling of sensitive data categories meets the stricter rules.