French data protection law on health research applies to all sponsors, whatever their country of establishment, when they perform clinical trials in France.
In the context of COVID-19, the French Medicines Agency (ANSM) now allows for adjustments to clinical trials, and has published guidance explaining which adjustments are possible and under which conditions.
However, the ANSM made very clear that any adjustment must remain in line with the rules governing data protection.
With respect to home delivery of medicines and health products, which is made in order to avoid unnecessary visits of patients to the site, the ANSM underlines that the requirements of the “reference methodology” MR-001 from the CNIL must be complied with and explains which information notice requirements must be followed in this specific case. Notably:
Concerning the new information which must be given to the patient about the processing of his personal data by the subcontractor for purposes of delivery, the ANSM considers that such information should be provided in two-steps, as follows:
In practice, this means that a two-layered approach must be followed: first a short information prior to the delivery which can be for instance by phone, and then a complete written information notice, fully compliant with the GDPR and MR-001, to be provided at the latest at the time of delivery.
The ANSM recalls that in case the lock down prevents the performance of monitoring on site, no transmission of copies of medical records or remote access to electronic medical records should be authorized, even if the data is pseudonymised.
This is in line with the principle of medical secrecy and the confidentiality of personal data, and the MR-001 from the CNIL.
For any question, please send an email to:
Last reviewed: 20 April 2020
 The “reference methodology” MR-001 is a standard established by the CNIL (the French Data Protection Authority) specifying all the data protection conditions governing the clinical trial. Compliance with this reference methodology enables to avoid requesting a specific authorization from the CNIL to perform the trial. If compliance to MR-001 is not possible, an authorization must be obtained from the CNIL.