CNIL Updates Two Standards For Health Research (MR-001 and MR-003)
France's data protection authority, the CNIL, released updated versions of two core frameworks — MR-001 and MR-003 — that set the rules for how personal health data can be processed in research contexts. These reference methodologies function as pre-approved compliance pathways under French law, allowing qualifying health research to proceed without seeking individual authorization.
Why this matters: Health data is about as sensitive as it gets. These frameworks determine what researchers can do with it, and who has to ask permission first. When the CNIL updates the rules, organizations running clinical studies, epidemiological research, or public health programs may need to revisit how they operate. If your work touches French health data and you have been relying on MR-001 or MR-003 to stay compliant, the old version may no longer cover you. Worth checking what changed before assuming your current setup still qualifies.
Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.