The association “La Quadrature du Net” applied to the Conseil d’État’s urgent applications judge with a request for the suspension of France’s “health pass”, fearing the use of sensitive personal data (marital status, proof of vaccination status or test results). The urgent applications judge noted that this device (in its paper or digital version) is not required for everyday activities or the exercise of certain fundamental freedoms (demonstrations, meetings, acts of worship). He further notes that the digital version is optional and that the information collected is stored on the individual’s mobile phone, thus limiting its processing or storage on national databases. The urgent applications judge considers that the “health pass” does not cause any serious and unlawful harm to privacy rights or to data protection rights.
In application of the law on the management of the process for exiting the health crisis, since 9 June, France’s Prime Minister has required that a “health pass”, either paper or digital, must be shown in certain situations.
In accordance with the law, this document must be shown only to enable verification that the holder meets one of the three required conditions (negative Covid-19 test result, proof of vaccination or recovery following infection), without being able to identify which condition has been met or the personal data associated therewith.
The “health pass” is not required for day-to-day activities
The urgent applications judge noted that the “health pass” is making it possible to reduce the spread of the virus by limiting flows and transmission between individuals. The pass is only required for travel to or from foreign countries, Corsica or the French Overseas Departments and Territories, and for access to certain places, establishments or events involving large gatherings of people (leisure activities, trade fairs, etc.).
It is not required for the exercise of freedom of worship, assembly or demonstrations or for day-to-day activities (work, shopping, restaurants, etc.).
An optional digital version
The urgent applications judge noted that the digital “health pass” is optional and is based on the storage and control by each individual, on his or her own mobile phone, of some of his or her health data (“Record” module of the TousAntiCovid application). This choice limits the collection and processing of health data via national databases and reduces the risk of hacking or error. In addition, the TousAntiCovid Vérif application also checks supporting documents locally.
The judge considers that the “health pass” does respond to a matter of public interest for the protection of community health and that the data collected are limited and appropriate with regard to the objectives pursued (principle of minimisation).
For these various reasons, the urgent applications judge considers that the “health pass” does not cause any serious and unlawful harm to privacy rights or to data protection rights.
Read the decision n°453505 (in french)