CDP Sénégal: Loi Protection Données Santé Numérique Adaptation Urgente

• Senegal's digital health transformation, offering benefits like telemedicine and AI, faces significant challenges in protecting sensitive patient data.
• The existing Law n°2008-12, enacted 18 years ago, is deemed insufficient to address modern digital health technologies and practices.
• Health data, linked to private life and medical secrecy, requires enhanced legal protection due to its unique sensitivity.
• The issue extends beyond individual privacy to Senegal's digital and health sovereignty, particularly concerning cross-border data transfers.
• The CDP and a coalition led by Transform Health Sénégal advocate for a new, dedicated legal framework for digital health.

The challenge extends beyond individual privacy to encompass Senegal's broader digital and health sovereignty.

Senegal's healthcare system is undergoing a significant digital transformation, promising substantial advancements such as improved access to medical care, the implementation of digital patient records, the expansion of telemedicine services, enhanced medical research capabilities, more effective epidemiological surveillance, and the integration of artificial intelligence (IA santé Sénégal cadre juridique). However, alongside these promising developments, a critical, less visible challenge has emerged: the robust protection of patients' personal data. The Commission de protection des données personnelles (CDP Sénégal protection données santé) views the current legal framework as needing urgent evolution to adequately address technologies and practices that did not exist when the foundational law was adopted.

Mohamed Diop, formerly the Permanent Secretary of the CDP, is now the Director of Commercial and Marketing Development at Ciments de l'Afrique. He underscores that legal protection is "never sufficient" because technological advancements and practical applications are in constant flux. This rapid evolution is particularly pronounced in the health sector, where a growing array of digital tools are capable of collecting, processing, transmitting, and storing sensitive medical information. Health data is inherently distinct from ordinary personal data; it provides intimate insights into an individual's physical or mental state, directly implicating their private life and being inextricably linked to medical secrecy. Consequently, its handling demands an elevated level of security and confidentiality.

The digitalization process fundamentally alters how medical information is managed. Patient medical records, traditionally confined to physical archives within healthcare facilities, can now be integrated into extensive digital platforms, accessed remotely by authorized personnel, or continuously updated by connected health devices. The proliferation of télémédecine Sénégal protection données and various health applications further multiplies the entry points for sensitive data into the system. This phenomenon is precisely what the Transform Health campaign, "Mes Données, Notre Santé," aims to highlight: the immense volume of health data generated by digital transformation and the crucial questions surrounding its collection, usage, storage locations, and operational conditions.

Senegal is not entirely without regulatory mechanisms for data protection. The existing Loi n°2008-12 Sénégal santé numérique, enacted on January 25, 2008, serves as the cornerstone of the country's data protection framework. This legislation specifically safeguards health data and confers several fundamental rights upon individuals whose data is processed. It established important principles for the handling of personal information at a time when digital health was nascent.

However, nearly two decades after its adoption, this foundational text is widely recognized as requiring significant adaptation to a profoundly transformed technological environment. The Permanent Secretary of the CDP acknowledges the "existing" framework but strongly advocates for its reinforcement, emphasizing that the original law could not foresee the complexities of today's digital landscape. The need for this adaptation is particularly acute with the widespread integration of artificial intelligence in healthcare, the emergence of sophisticated new digital health tools, and the accelerated development of medical research, all of which rely heavily on vast datasets.

While the sharing of health data holds immense potential for public health, enabling better disease prevention strategies and enhancing epidemiological surveillance, such practices must be meticulously governed. Any utilization of this sensitive information must occur within a robust legal framework that unequivocally guarantees the rights and privacy of individuals. The current law, while foundational, needs to evolve to provide specific guidance and stronger safeguards for these advanced applications.

The implications of digital health data management in Senegal extend far beyond individual privacy concerns, touching upon the nation's broader Sénégal souveraineté numérique données santé and health autonomy. A critical aspect of this challenge arises from the potential for health data to be hosted or transferred to third countries, particularly when healthcare institutions opt for external technological solutions or cloud services. This practice raises significant questions about national control over sensitive information.

Mohamed Diop stresses the imperative for Senegal to establish greater mastery over the conditions under which its population's health data is stored, processed, and utilized. Ensuring national oversight and control is vital for maintaining trust and protecting strategic national interests. This concern for sovereignty is a central tenet of Transform Health Sénégal, a broad coalition that unites civil society organizations, community structures, youth and women's networks, and other key stakeholders committed to advancing the digitalization of the health system and improving data governance.

The coalition actively advocates for the adoption of a comprehensive legal framework specifically dedicated to digital health. This proposed framework would aim to address the gaps in the existing legislation, providing clear guidelines for data handling, cross-border transfers, and the ethical deployment of advanced technologies like AI in healthcare. Such a legislative adaptation is seen as crucial for harnessing the benefits of digital health while rigorously protecting the rights and sovereignty of the Senegalese people.

Lawyers and compliance officers in Senegal should note that the existing 2008 data protection law is deemed insufficient for current digital health technologies and AI. This signals upcoming legislative reforms or heightened enforcement focus on health data, cross-border transfers, and data sovereignty, requiring proactive review of client practices for compliance gaps and preparation for new regulatory requirements.

Source: Original reporting via SenePlus