Editing Council of State - 253.677 (section)

==English Summary==
===Facts===
VIVALIA, a public network of hospitals, launched a call for proposals to find a contractor to process patient data of hospitals for statistical purposes. The public contract was awarded to 3M Belgium, a Belgian company that had been in the news for allegedly transferring data to the US and Russia without appropriate safeguards. 

On this basis, a spin-off of the UC Louvain (CIBES), which also took part in the public procurement procedure, challenged VIVALIA's decision before the Council of State.
===Holding===
The Council of State considered that, before awarding a public contract, the public authority ought to make the necessary verifications regarding the submitted proposals and to correctly motivate the reasons why it could consider that the selected proposal presented the "sufficient guarantees" to consider that the entrusted data and information would be processed in compliance with the GDPR. 

The decision to award the contract was suspended, without the Council of State examining whether or not the two bidders (CIBES & 3M) complied with the GDPR.