On April 8, 2025, during a question session to the French government at the National Assembly, Emmanuel Maurel, a deputy representing the 3rd constituency of Val-d’Oise, raised serious concerns about the approval granted by the CNIL (French Data Protection Authority) for the Darwin EU Project. This initiative, known as the Data Analysis and Real-World Interrogation Network for the European Union, aims to utilize certain data from France’s National Health Data System (SNDS) to conduct various studies that will inform regulatory decisions across the European Union.
The core issue highlighted by Maurel was related to the French contribution to the project: the transfer of data, predominantly from the National Health Insurance Fund (Caisse nationale d’assurance maladie), which covers a randomly selected sample of 10 million French citizens. What alarmed Maurel was the fact that this sensitive information would be managed by the Health Data Hub and hosted on Microsoft’s Azure cloud platform.
Concerns Over Data Security and Sovereignty
Maurel questioned the safety of entrusting such highly confidential data to a multinational corporation like Microsoft. He emphasized the risks by referencing the Cloud Act, a law enacted during Donald Trump’s presidency, which authorizes U.S. authorities to access data held by American cloud providers, even if the data is stored abroad.
"How can we believe it is safe to entrust such sensitive information to Microsoft?" Maurel asked. "I remind you that under the Cloud Act, the U.S. government can access the confidential data of their domestic companies in the name of national security. Frankly, it is highly likely that Mr. Trump would exploit this extraterritorial authority to the fullest."
He then directed a question at Clara Chappaz, the delegated minister responsible for artificial intelligence and digital issues: "Will your government prioritize adopting a European or even French hosting solution instead of risking our national interests?"
Official Response from the French Government
In response, the minister stated that discussions are ongoing with the Ministry of Health to commission a tender aimed at migrating the Health Data Hub to a more secure hosting provider. She acknowledged the importance of this move but did not specify any deadlines or project timelines.
"Together with the Minister of Health, we will initiate a call for tenders to transfer the Health Data Hub to a secure host. This is very important," she declared.
However, no specific schedule or implementation timeline has been announced at this stage.
Legal and Political Reactions
Several advocacy groups, including the French Human Rights League, have expressed their stance publicly through a joint opinion published in Libération. They announced plans to challenge the project before the Council of State, criticizing governmental policies concerning digital sovereignty.
"The government assures us that a European hosting provider will be selected through a call for tenders. Words, just words," the groups lament, highlighting their distrust in the government’s commitment to safeguarding national interests.
The Broader Context: Data Privacy and Sovereign Cloud Initiatives
This controversy echoes past debates over data repositories hosted on the Health Data Hub—specifically, the EMC2 data warehouse project. In January 2024, CNIL approved EMC2, an initiative developed in collaboration with the European Medicines Agency, which aimed to provide access to parts of the SNDS database for three years.
CNIL acknowledged that some data transfers involving technical usage of the platform might occur between the U.S. and Europe but insisted that these operations would be governed by standard contractual clauses drafted by the European Commission.
However, a comprehensive expert mission, organized by authorities to investigate the matter further following CNIL’s questions, revealed that no providers solely compliant with European law could meet the technical and operational needs critical for deploying the EMC2 project within the required timeframe. The growing tension around data sovereignty continues to fuel concerns over reliance on U.S. cloud services for sensitive national data, raising questions about France’s capacity to maintain control over its digital infrastructure.
[Video content or additional multimedia references omitted for brevity]
This ongoing saga underscores the broader issues facing countries attempting to balance technological advancement with the preservation of digital sovereignty and data security. As governments and institutions grapple with these challenges, decisions such as those surrounding the Darwin EU Project will likely remain at the heart of debates over privacy, security, and the future of European digital independence.
