APDP • Deliberation No. 2026-02 of 14 January 2026 issuing an opinion on the draft law on confidentiality in medical, medico-social and social contexts

The Personal Data Protection Authority (APDP) issued its Deliberation No. 2026-02 of 14 January 2026 giving its opinion on the draft law on confidentiality in the medical, medical-social or social contexts, following referral by the Minister of State on 18 September 2025, received on 22 September 2025, in accordance with Article 38, paragraph 2 of Law No. 1.565 of 3 December 2024 on the protection of personal data.

In the Preamble, the APDP recalls the legal basis for the protection of medical data:

• Article 8 of the European Convention on Human Rights (ECHR) on the right to respect for private and family life,
• Article 308 of the Criminal Code on professional secrecy,
• Article 4 of the Code of Medical Ethics on confidentiality, which "covers everything that has come to the doctor's knowledge in the course of his or her professional practice, i.e. not only what has been confided to him or her, but also what he or she has seen, heard or understood".
• Law No. 1.454 of 30 October 2017 on consent and information in medical matters, as amended.

On the content of the bill (PL):

I. Definitions (Article 1 PL)

• Health data to be defined
  The APDP considers it essential that the bill expressly define "health data", which is the core of the information protected by confidentiality. It refers to the definition in Article 2(6) of Law No. 1.565 on the protection of personal data, while emphasising the broad interpretation adopted by the Court of Justice of the European Union (CJEU) in a judgment (Grand Chamber) of 4 October 2024, according to which the classification of health data can be deduced solely from the context in which the information relating to the persons concerned is mentioned and which allows conclusions to be drawn about a person's state of health, either directly or indirectly.
• Welcome inclusion of medical-social and social workers
  The APDP considers it appropriate that the bill also covers medical-social and social workers, who are now clearly defined and subject to a duty of confidentiality. This addresses previous concerns regarding the protection of social data, which would now be protected by confidentiality but would not be sensitive data within the meaning of Law No. 1.565. The APDP emphasises that non-medical data relating to the social sphere remains accessible to it.
• Overly broad definition of the care team
  The APDP considers that the broad definition of the care team, which includes not only healthcare professionals but also medical-social and social workers who are directly involved in the "medical, medical-social or social care" of the same patient, does not allow for a clear assessment of the scope of the tasks entrusted to them. It recommends better defining this concept by limiting it, as in French law, "to the performance of a diagnostic or therapeutic act, the compensation of a disability, the relief of pain or the prevention of loss of autonomy, or to the actions necessary to coordinate several of these acts" (Article L1110-12 of the french Public Health Code), and to expand it to include support for disability and loss of autonomy.
• Risk of omission concerning the list of healthcare professionals and establishments
  The APDP notes the risk that the list may omit healthcare professions that do not enjoy special status in the Principality but which, in practice, are included in a healthcare pathway in the neighbouring country (or, in fact, in Monaco), and that any communication of strictly necessary data by a doctor to these professions could therefore constitute a breach of professional confidentiality.

II. Persons bound by secrecy (Chapter I PL)

• Individual rights to be strengthened
  The APDP recommends aligning the wording of Article 2 PL with point I of Article 1110-4 of the French Public Health Code and introducing the concept of "right to privacy", which contextualises the framework within which the obligation to respect medical confidentiality applies. It also stresses the need to raise awareness among all personnel subject to confidentiality, including those in health and medico-social establishments, of the strict need to respect confidentiality. Furthermore, the APDP recommends specifying that only data that is strictly necessary may be transmitted for analysis or billing purposes, and considers it appropriate to maintain the obligation of confidentiality after the patient's death.
• Extension of the obligation of confidentiality
  The APDP recommends rewording Article 3 of the bill to specify the categories of "persons in relation" to the professionals and establishments concerned to whom the obligation of confidentiality is extended (students, trainees, external service providers, association representatives, etc.) and the means of ensuring compliance with confidentiality.

III. Exchange and sharing of information between persons bound by confidentiality (Chapter II PL)

• The APDP emphasises the importance of specifying that the exchange and sharing of information relating to a patient must be carried out using secure means, and the importance of providing clear information to the data subject. With regard to the withdrawal of consent to exchange and share information when professionals do not belong to the same healthcare team, the APDP points out that this must be as simple as granting consent and adapted to the individual's capacity for discernment. Finally, the APDP questions the advisability of allowing partial opposition to the sharing of certain data and recommends that individuals be informed that exercising the right to object or withdrawing consent has no retroactive effect.

IV. Exemptions from confidentiality (Chapter III PL)

• Professionals to whom confidentiality does not apply
  The APDP emphasises the importance of reviewing existing legal exemptions and those to be introduced. It notes that the exemptions provided for in Article 308-1 bis of the Monegasque Ciminal Code, which allow doctors, healthcare professionals and social workers to breach confidentiality, are more limited than those provided for in Article 226-14 of the French Criminal Code. It also draws attention to the debates in France concerning the possible lifting of confidentiality in favour of supplementary insurance organisations.
  
• Creation of an exemption for approved doctors under the regulations relating to medical checks on fitness to drive
  The APDP recommends the deletion of Article 13 PL, which provides that the medical certificate of fitness or unfitness to drive issued by the approved doctor must be sent by that doctor to the public health inspector, who forwards it to the Vehicle Licensing Agency, after verifying "that this certificate contains no medical information other than the mention of fitness or unfitness to drive". It considers that this measure would constituting a disproportionate infringement of the right to privacy.