[Enforcement library](/enforcement)

# Cegedim Santé: pseudonymous health records still required the right authorisation

CNIL fined Cegedim Santé EUR 800,000 over health-data processing that the authority found was pseudonymous rather than anonymous.

## Key facts

- **Regulator or court:** CNIL
- **Jurisdiction:** France
- **Framework:** GDPR Article 5(1)(a); French Data Protection Act Article 66
- **Record date:** 2024-09-05
- **Procedural status:** Administrative fine; later appeal status not established

CNIL fined Cegedim Santé EUR 800,000 over health-data processing that the authority found was pseudonymous rather than anonymous.

CNIL · GDPR Article 5(1)(a); French Data Protection Act Article 66 · Decision: 5 September 2024

## The problem

A health-data export can remain personal data even when obvious identifiers have been replaced.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | CNIL |
| Jurisdiction | France |
| Law | GDPR Article 5(1)(a); French Data Protection Act Article 66 |
| Decision date | 5 September 2024 |
| Recorded fine | EUR 800,000 |
| Procedural status | Administrative fine; later appeal status not established |
| Source review | 19 October 2026 |

Primary record: [CNIL notice published on EDPB](https://www.edpb.europa.eu/news/commercial-prospecting-french-sa-fined-cegedim-sante-eur-800-000_en).

## What the authority found

CNIL's notice describes data collected through medical software and used for health-sector studies and statistics. It found that patients could be re-identified by reasonable means, so the records were not anonymous. [CNIL notice published on EDPB](https://www.edpb.europa.eu/news/commercial-prospecting-french-sa-fined-cegedim-sante-eur-800-000_en).

The authority found missing required health-sector formalities and unlawful automatic collection of reimbursement-history data when doctors consulted the relevant service. [CNIL notice published on EDPB](https://www.edpb.europa.eu/news/commercial-prospecting-french-sa-fined-cegedim-sante-eur-800-000_en).

## Outcome and limits

CNIL imposed EUR 800,000. This record follows the authority's notice published on EDPB; the full national decision was not reviewed. No later appeal result or payment is asserted. [CNIL notice published on EDPB](https://www.edpb.europa.eu/news/commercial-prospecting-french-sa-fined-cegedim-sante-eur-800-000_en).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Map which identifiers and attribute combinations survive each export and whether records can be linked over time.
- Separate a clinician's ability to consult information from automatic collection for a secondary purpose.
- Have the relevant privacy and clinical teams establish applicable authorisations, legal bases and re-identification controls.

## How Inth helps

Code audit can help trace reviewed data collection, storage and external destinations.

It cannot certify anonymisation or grant the health-sector authorisations considered in this decision. A browser scan cannot assess an internal health-data warehouse.

## Sources and limits

- [CNIL notice published on EDPB](https://www.edpb.europa.eu/news/commercial-prospecting-french-sa-fined-cegedim-sante-eur-800-000_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.