Court contest over Microsoft’s award of the EMC2 hosting market

“This deliberation is a call for help from the National Commission for Information Technology and Liberties“, according to Nicolas Chagny, president of the Internet Society France, the French branch of the non-governmental organization whose mission is to protect Internet users. Contacted by The Digital Factorydesignates Deliberation made by the authority on December 21, 2021 which authorizes for three years the hosting by Microsoft Azure of health data constituting the warehouse called “EMC2”, “lack of service provider capable of currently meeting the needs expressed“.

This warehouse is the response to a call for projects launched by the European Medicines Agency (EMA), of which the Health Data Hub – as a public interest group – inherited lot 3. Its objective is to “enable research, studies and evaluations to be carried out” in the field of health to observe and evaluate patient care, characterize patient populations or even design and validate tools to help interpret signals, help with diagnosis or help with preventive or curative care.

An educational remedy

The choice of an American cloud provider unsurprisingly provoked an outcry from French companies in the sector. The Internet Society is the first to file a legal appeal to overturn the CNIL's decision. But for France Charruyer, lawyer at the ALTJI firm and advisor to the Internet Society France, “it is not a militant appeal but rather an educational one.”. Out of the question of “pillory the CNIL“. Indeed, as the lawyer explains to The Digital Factory“under the pyramid of norms, the authority had no choice” to validate the award of the market to Microsoft. Since the adoption of the Data Privacy Framework – successor to the Privacy Shield – transfers of personal data to UNITED STATES are authorized since an equivalent level of protection has been recognized.

Nor does this appeal aim to say that “Microsoft is a bad host“, adds the president of the applicant NGO. On the other hand, “concerning the health data of the French, we cannot resolve to say that there is no European actor capable of hosting this database“. In its deliberation, the CNIL relies on an expert mission led by the Digital Health Delegation (DNS) which concluded that French and European cloud offers did not meet the current needs of the EMC2. “I can not believe itsays the president. If it is true, that means that it is serious and therefore that the public authorities must put all the financial resources into making it possible to do so.“For her part, the lawyer wishes that proof of the absence of an adequate offer to meet the expressed needs be clearly provided.

(…)