In Circular No. 6519/SG [1] dated 5 February 2026, Prime Minister Sébastien Lecornu sets out the framework for the State’s digital public procurement and reiterates the requirement to rely on the SecNumCloud qualification for hosting data of particular sensitivity, including health data. The circular establishes digital sovereignty as the...
Read
Jeanne BOSSI MALAFOSSE is head of the Personal Data Department and co-head of the Life Sciences Department.
She has significant experience in personal data protection and various questions relating to life sciences, particularly in the area of health information systems.
She assists organizations in the following subjects :
- compliance with personal data protection principles in all sectors
- preparation for Europe’s General Data Protection Regulation
- regulatory framework of planned health information systems
- regulatory framework of BtoC and BtoB rules
- managing new regulations for exchanging and sharing health data in the health and medicosocial sectors
- contracts for hosting health data and coordination of the various authorizations required
- consultations on the conditions for accessing health data in particular for medical research (Health Data Hub, CNIL, Ethics Committees, CESREES, CNIL)
- compliance audits of the structures
- conduct of data protection impact assessments
- maintaining registers of processing activities
- DPO accreditation and service offering
- negotiation and contract drafting
- data protection policies
- CNIL/supervisory authority inspections
- Big Data and AI issues
Following law studies and a qualification from PARIS Institute of Political Studies, Jeanne BOSSI MALAFOSSE began her career at the Caisse des Dépôts et Consignations before joining the French Data Protection Authority (CNIL), where she spent eighteen years from 1991 to 2009. Here she held the positions of Deputy Director of User Relations and Supervision, Head of the Public and Social Affairs Division and Head of the Health, Health Insurance and Medical Research Sector.
She then held the position of Secretary-General of the National Agency of Shared Health Information Systems (ASIP Santé, now ANS), where she managed and organized the agency’s support functions and contributed to defining the grouping’s strategy and launching national information system projects in consultation with stakeholders in the health sector.
She is also a Council of EUROPE expert for drafting the new recommendation on health data protection and is a member of the Big Data and Prevention working group of the Healthcare Data Institute.
She has been appointed as a qualified personality within the scientific and ethical committee « Cancer data platform » of the French National Cancer Institute and within the general assembly of the Health Data Hub.
Jeanne BOSSI MALAFOSSE contributed to the White Paper « Digital innovation in health : ethics at the heart » published by SANOFI in June 2021. She wrote the chapters « Digital tracking and personal data protection at the time of COVID-19 » and « Digital data protection in health ».
She is a member of the French Association of Data Protection Officers (AFCDP).
She is also currently a lecturer in various French universities
- Lille law university, Master 2 in Health Law ;
- Paris Descartes University, university degree in personal data protection ;
- Bichat medical school, university degree in connected objects ;
- Conservatoire National des Arts et Métiers (French Conservatory of Arts and Crafts).
Jeanne BOSSI MALAFOSSE is a « Leading individual » in the Healthcare & Life sciences category of the Legal 500 EMEA since 2023.
Jeanne is ranked in Band 3 in Pharma/Life Sciences : Regulatory by Chambers since 2026.
She was also elected as one of the Lawyers of the Year 2022 in « Life sciences » by Le Monde du Droit (Palmarès du Droit 2022).
Jeanne has been recognized by Best Lawyers since 2020 in “Privacy and Data Security Law”, “Biotechnology and Life Sciences Practice” and “Information Technology Law” (Best Lawyers, in partnership with Les Echos).
In its decision of 10 February 2026, WhatsApp Ireland Ltd v European Data Protection Board (Case C-97/23 P) [2], the Court of Justice of the European Union (“CJEU”) held that a decision of the European Data Protection Board (“EDPB”) constitutes an act that may be challenged before the EU courts. In this case, following complaints relating to data...
ReadIn 2023, the CNIL established a dedicated service for the economic analysis of issues related to personal data, with the aim of strengthening its expertise and informing its decisions through impact assessments, sectoral analyses, and quantitative studies evaluating the economic effects of its rulings. It is indeed essential for a data...
Read
