France: Prime Minister adopted Decree No. 2026-209 amending provisions of the public health code relating to the hosting of personal health data

On 24 March 2026, the Prime Minister adopted Decree No. 2026-209 of 24 March 2026, amending certain provisions of the public health code relating to the hosting of personal health data, made for the application of Article 32 of Law No. 2024-449 of 21 May 2024 aimed at securing and regulating the digital space. The decree applies to patients, natural or legal persons responsible for the processing of personal health data, providers contributing to the provision of a personal health data hosting service, and certification bodies. It inserts Article R. 1111-9-1 into the public health code, requiring that storage of personal health data on digital media be carried out exclusively on the territory of a Member State of the European Union (EU) or party to the Agreement on the European Economic Area (EEA). Where a host or subcontractor involves a transfer, including remote access, to a non-EU or non-EEA country, this is permitted only under an adequacy decision pursuant to Article 45 of Regulation (EU) No. 2016/679, or where appropriate safeguards under Article 46 of that Regulation are in place with enforceable rights and effective legal remedies available to data subjects. The decree also amends Article R. 1111-11 to require hosting contracts to disclose applicable extra-European regulations, adequacy decisions or their absence, mitigation measures, and residual risks of transfer or unauthorised access to personal health data. Hosts must make public and keep updated a mapping of transfers, remote access, and risks of unauthorised access to personal health data. Articles R. 1111-9, R. 1111-9-1, and R. 1111-11 are extended to the Wallis and Futuna Islands. The decree enters into force the day after its publication, with the exception of points 2° and 3° of Article 1, which enter into force within a period of six months following the date of that publication.