CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The agenda signals upcoming CNIL scrutiny of new automated data processing initiatives affecting law‑enforcement and health research.
ADTP Regulatory Watch· September 3, 2026· Commission nationale de l'informatique et des libertés (CNIL)
ImpactModerate 58
Type📋 Proposed Regulation
Statusannouncednot law
JurisdictionEU-FR
What happened
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA Operations France and Kalixia to use automated processing of health data from ESND and PMSI.
Why it matters for trust and compliance
Its status is announced. It is not law yet. Track it, but do not treat it as an obligation.
The agenda signals upcoming CNIL scrutiny of new automated data processing initiatives affecting law‑enforcement and health research.
It relates to GDPR. The regulations library explains what that law requires.
Who is affected
healthcaregovernmenttechnologycontrollerprocessorRandomized clinical trials (RCTs)IQVIA Operations FranceKalixiadirection générale des Finances publiques
Recommended actions
Check that privacy notices describe the practices this addresses.
Confirm access, correction, deletion and opt-out requests are handled within the required time.
Revisit retention schedules and data minimisation for the data involved.
Inventory AI or automated decision systems in scope and their assessments.
Confirm handling of sensitive data categories meets the stricter rules.