On the occasion of European Data Protection Day, this January 28, 2025, the Paris Brain Institute is highlighting personal data protection through its Data Protection Officer (DPO). In this profile, Frédérique Lesaulnier, who is also a member of the Institute’s Ethics and Professional Conduct Committee, discusses her background, explains the challenges of data protection, and how the Paris Brain Institute is committed to this important issue.
What is your background?
I am a legal expert specializing in the protection of health data. My interest in data protection law is not new, as I wrote a doctoral thesis on the concept of personal data, which I defended in 2005 at Panthéon-Assas University.
My passion for teaching and research, and the years I spent teaching law—as a teaching assistant and then as a temporary lecturer and research associate (ATER) at Paris XI University—seemed to lead me toward an academic career. However, an internship at the French Data Protection Authority (CNIL) changed that path.
I spent nearly ten exciting years in the CNIL’s Legal Affairs Department, first as a legal expert and then as coordinator of the Health Division. By working alongside stakeholders, the CNIL helps to develop a living legal framework that sacrifices neither principles nor real-world activity. This kind of “rigorous flexibility” has always guided my approach. After covering all aspects of the Health Division's work and representing the commission before key stakeholders in the field, I wanted to get closer to the research community and work directly in the field.
It was only natural that I turned to Inserm, the French national institute for health and medical research, where data protection issues are critical and whose cases had been among the most compelling I had worked on. I spent seven intense and fruitful years there—first as a project officer with the Public Health ITMO leadership, helping to support researchers’ access to the French National Health Data System (SNDS), and then as DPO for Inserm. I was awarded the 2020 Innovation Prize for my work during the COVID-19 health crisis. We had to rapidly develop robust projects and involve all relevant expertise—scientific, of course, but also technical and regulatory, including data protection—right from the start, in line with the very spirit of the GDPR!
The Paris Brain Institute, which I joined in 2021, is precisely designed and organized to promote this kind of collaborative, agile working method, delivering efficiency and responsiveness in support of researchers, patients, and at-risk individuals. It is incredibly stimulating for me to contribute to the ICM Foundation’s facilitative role in neuroscience research, all while ensuring strong data protection standards.
What are the data protection challenges at the Paris Brain Institute?
As part of its work, the Paris Brain Institute processes personal data concerning staff members, donors, and also health data from study participants. The Institute sees it as a duty to act with vigilance and set an example in its use of such data to safeguard individuals’ fundamental rights. This is especially true when it comes to health data, which are sensitive and subject to enhanced protection rules.
The protection of personal health data is, naturally, a top priority for the Institute. Such data are the raw material for scientific research, whether they are clinical data—possibly linked to biological samples—medical imaging data, research data, or data from health insurance systems. Their analysis allows researchers to make daily progress in understanding how the brain works, the mechanisms of diseases, risk factors, and how to improve both care and prevention.
We must therefore promote the responsible use and sharing of these valuable resources, developed in the public interest and meticulously curated for high-quality research. At the same time, we must honor the trust of individuals who have agreed to share their data, ensuring their contributions are fully leveraged in ways they would hope for. This is especially critical for rare, sometimes severe, diseases, which require access to a sufficient number of data sets and/or biological samples from patients in order to conduct meaningful analyses—often through collaborative efforts.
Handling such sensitive data requires a high level of diligence, expertise, and critical thinking—all within a clear ethical, legal, and regulatory framework. That’s why protecting research participants’ rights and securing their data must be ongoing priorities in scientific work and in developing data access systems. These requirements are safeguarded by law. It’s not only about compliance—it’s a matter of scientific quality and earning the trust of those who contribute to scientific progress.
How is the Paris Brain Institute committed to protecting personal data?
The Institute’s leadership has implemented a data protection policy based on shared commitment and individual accountability. This policy has been widely communicated. To help researchers and staff integrate best practices into their work and meet the legal and technical challenges of regulation, the Institute has built dedicated, multidisciplinary teams and encourages essential collaboration, both within the Institute and with its partners.
This effort to provide close support has included reinforcing the DPO role, which serves as the main point of contact with the CNIL.
The regulatory framework is complex and constantly evolving. It is best followed when it is well understood by the people processing the data. Regular awareness and training campaigns on the GDPR and its requirements are carried out for staff, including both researchers and administrative support teams.
The DPO also provides educational tools to the teams (guides, internal intranet resources, etc.), tailored to operational needs. These materials help staff understand the legal framework, develop good habits, and stay on track with compliance processes.
The role of research participants is crucial, and their right to be informed about how their data are used must be respected. A guide is available to help teams write clear, regulation-compliant information sheets. A dedicated Transparency Portal for research participants completes the system.
Preparing and submitting regulatory authorization requests for studies has become complex. Anticipation is key to avoid “missteps” that cost time and energy. By meeting with researchers at the project design stage, we help them identify the correct procedures, integrate regulatory constraints into their methodology, and build solid files that can obtain authorization quickly—and also serve as “roadmaps” for researchers.
Finally, the Paris Brain Institute and its researchers have a voice to be heard in shaping the standards that apply to them. Thanks to ongoing dialogue between the DPO office, researchers, the RIPH cell (ethics and human subjects research team), and other DPOs, the Institute has contributed to the CNIL’s public consultation on health data guidelines. We will enthusiastically continue these efforts—working together with policymakers and stakeholders—to build a regulatory framework that is both rigorous and effective, facilitating research that benefits public health while promoting responsible science.
