CNIL clears synthetic oncology dataset for open data

The Commission nationale de l'informatique et des libertés has authorised BIG DATA SANTE, operating as Octopize Mimethik Data, to build an anonymised dataset of fictitious oncology patient profiles for medical research.Legifrance Délibération No. 2026-112Legifrance of 8 October 2026, on request No. 9-421Legifrance, permits the automated processing that will create the dataset known as ONCOVALLegifrance.

Octopize develops and sells a specific health-data anonymisation technique: its Avatar program generates, from source records, anonymised data that keep enough utility for research, known as synthetic data. Here it is applied to health data of patients followed in oncology, producing fictitious but realistic profiles for testing and validating medical research methods. Though health-related, the project does not pursue health research or care-practice evaluation as such, so it falls outside the specific LIL health-research provisions and outside every existing reference methodology; the authorisation itself describes all its essential characteristics. The health-research ethics committee had given a favourable opinion on 7 May 2026.Legifrance

The purpose — building synthetic oncology profiles to facilitate research — is determined, explicit and legitimate. The processing rests on legitimate interestsLegifrance, meets the public-interest requirement for health-domain processingLegifrance, and satisfies the health-data processing conditionLegifrance. Designed for the Health Data Platform call on industrial data sharing, the Octopize–PDS agreement provides for the synthetic data to be released as open dataLegifrance.

The source data are only reused records: the Roche Personalised reimbursement model study (authorisation No. 919125), limited to 25,000 breast-cancer and 5,000 lung-cancer patients over 2015–2020, and files of 500 lung-cancer patients followed between 2016 and 2023 from Medipath laboratory software. Octopize sees only pseudonymised dataLegifrance — names and the national identification number are not transmitted, and the PDS checks pseudonymisation at entry. It sees year of birth, sex, date of death where applicable, plus diagnoses, laboratory results, weight and height at care, care dates and treatment calendars.

The PDS, as subprocessor, verifies pseudonymisation, makes the data available and hosts them securely, targeting only strictly necessary data. For each source patient, one synthetic individual is generated probabilistically from the nearest patients, with parameters tailored to each dataset's volume, granularity and rare values. Octopize justifies its parameter choices against Article 29 Working Party Opinion 05/2014 on anonymisation, with a systematic analysis report for each run.

Open-data release happens only if the output is anonymousLegifrance. Since release to indeterminate recipients heightens cross-referencing risk, publication must carry binding use terms banning re-identification attemptsLegifrance and a withdrawal plan for newly discovered risksLegifrance. The PDS must verify anonymity before releaseLegifrance and re-evaluate it at least every three yearsLegifrance. Only a small number of Octopize staff access the secure project space, and all pseudonymised data are deleted from it within 24 hours of the final reports.

Roche-study patients are not informed individually — that would take disproportionate effort — so an information notice is published on the Octopize and Roche websites before processing starts. Medipath patients receive individual postal information pointing to a notice on Medipath's transparency portal, with a 30-day delay before processing so they can objectLegifrance; this is set in the Octopize–Medipath contract. Rights can be exercised only during that 30-day pre-transfer windowLegifrance, after which the data travel without direct identifiers and no correspondence table is kept. The project space relies on the PDS security homologation granted on 22 July 2024 for three years.

The legal basis is CNIL Délibération No. 2026-112 of 8 October 2026 authorising the ONCOVAL processingLegifrance, under Regulation (EU) 2016/679 and Loi No. 78-17 of 6 January 1978, notably its Articles 44, 66 and following, 69 and 76.