Data Protection in France

Data Protection in France
Data Protection Authority:	CNIL (France)
National Implementation Law (Original):	Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés
English Translation of National Implementation Law:	[n/a English Translation]
Official Language(s):	French
National Legislation Database(s):	Légifrance
English Legislation Database(s):	n/a
National Decision Database(s):	Link

Legislation

History

The French government enacted its first data protection act in 1978, the Law n° 78-17 of 6 January 1978 relative à l'informatique, aux fichiers et aux libertés, so-called law "Informatique et Libertés". Directive 95/46/ex has been transposed by the law n° 2004-801 du 6 août 2004 which modified the law "Informatique et Libertés.

National constitutional protections

The right to the protection of personal data falls within the scope of application of the right to the respect for private life. Indeed, it is acknowlegded that the right to respect for private life protects individual from interferance, such as the disclosure or publication of personal data (see, Cassation, Civ. 1, 5 Nov. 1996).

The right to the respect for private life has a constitutional value in France, in accordance with the Constiutional Council decision of July 1999 (see, Constitutionnel Council, decision n° 99-416 DC of 23 July 1999). The Constitutional Council conferred to the right to the respect for private life a constitutional value as it is directly implied in Article 2 of the Declaration of Human and civic rights of 1789, which forms part of the body of constitutional rules and principles by reference to which the Constitutionnal Council can adjudicate.

National GDPR implementation law

In France the GDPR is implemented by the Law "Informatique et Libertés", as modified by the Loi n° 2018-493 of 20 June 2018 , the Decree n° 2018-687 of 1st August 2018 which has been enacted to implement the aforementionned Law and lastly, the Order n° 2018-1125 of 12 December 2018.

Age of consent

The age of consent is 15 years following Article 45 of the Law "Informatique et Libertés".

Freedom of Speech

The interplay between the right to the protection of personal data and the freedom of expression has been clarified by Article 80 of the Law "Informatique et Libertés".

Employment context

Article 44 of the Law "Informatique et Libertés" provides for a provisions which applies in employment context to the extent that it concerns the necessary processing of biometric data to the control of the access to the workplace and monitoring of apps and devices used during employees', interns', agents' tasks.

Research

The specific rules related to a processing for archival purposes in the public interest, for scientific or historical research or for statistical purposes are laid dwon in Articles 78 and 79 of the Law "Informatique et Libertés".

Other relevant national provisions and laws

The Law "Informatique et Libertés" gathers all the provisions related ot the processing of personal data. It includes cross references to other French laws such as labor law or criminal law.

National ePrivacy Law

The French government transposed the ePrivacy Directive by modifying several domestic laws. The Law "Informatique et Libertés" has been modified by the Law n° 2004/801 of 6 August 2004, the Law n° 575 of 21 June 2004 and the Law n° 669 of 9 July 2004.

Data Protection Authority

General information

The French Data Protection Commission (Commission Nationale de l’Informatique et des Libertés) is the national data protection authority for France.

→ Profile: CNIL (France)

Procedural information

Applicable Procedural Law

The CNIL operates under the law "Informatique et Libertés" under the conditions laid down by Articles 19 to 29. See the law here, in French. The law "informatique et Libetés" has to be read jointly with the Decree n° 2019-536 of May 29.

Complaints Procedure under Art 77 GDPR

According to Article 8, par.2 d) of the loi "Informatique et Liberté", a data subject or their representative(s) can lodge a complaint with the CNIL regarding an alleged infringment of the GDPR.

According to Article 10 of the Decree n°2019-536, the complaint will be deemed rejected if the CNIL did not reach the author of the complaint within a three months period, regarding its complaint - whatever the means-.

Ex Officio Procedures under Art 57 GDPR

The CNIL can run ex officio procedures out of its own motion. Its powers are described under Article 8 of the law "Informatique et Libertés".

Judicial protection

Civil Courts

The Civil Courts have jurisdiction to address privacy rights' issues insofar it does not fall within the scope of competence of the Administrative Courts.

Administrative Courts

The Administrative Courts have jurisdiction depending on the issue at stake, as clarified criteria determined and applied by the Court of Conflict (the "Tribunal des conflits").

The criteria are mainly established by case-law. In this regard, the most important decision is the Decision n°86-224 DC from 23 January 1987, where the Constitutional Coucil held that "the annulment or reversal of decisions taken, in the exercise of the prerogatives of public authority, by the authorities exercising executive power, their agents, the territorial communities of the Republic or public bodies placed under their authority or control;" falls under the jurisidiction of the Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows interrupted video surveillance over a public area. It is also well estbablished that administrartive courts are competent for issues concerning public works, administrative public services, public domains, public servants, etc..

The criteriae can also be prescribed by law.

The Supreme administrative Court (the "Conseil d'Etat") is the first and last judicial intance before which the CNIL's decisions are challenged, pursuant to Article R 311-1, par. 4 of the Code of Administrative Justice. Any CNIL's decision can be challenged with the conditions and limits provided for in the Code of Administrative Justice. More precisely, other admissibility requirements can be found below:

Regarding the decision : it can be the lack of response or the notification of the CNIL's decision to the data subject

• the data subject can challenge within the two months following the notification of the decision according to Articles R 421-1 to R 421-7 of the Code of Administrative Justice or within a three months period in the event where the CNIL did not issue a decision, pursuant to Article 10 of the Decree n° 2019-536 of May 29.

• The motion to institute proceedings must be presented to the Conseil d'Etat under the conditions set out in Articles R 411-1 to R 411-6,
• The motion has to be sent jointly with the decision at stake according to R 412-1 and R 412-2,
• it has to be filed with the Registry under the conditions set out in Articles R 413-1 to R 413-6 or transmitted elecronically by virtue of Articles R 414-1 to R 414-5

Regarding the data subject: the data subject has to prove he/she has a legal standing, his/her legal interest, his/her legal capacity

In addition to the proceeding described above before the Conseil d'Etat, the Administrative Courts are also competent to issue interim decisions in a urgent situation, where there is a serious and manifestly unlawful infringement of fundamental freedoms, under Article L 521-2 of the Code of Administrative Justice or where it exists a serous doubts as the legality of the decision, under Article L 521-1 of the same code.

You can find the all the provisions of the Code of Administrative Justice in French here.

Constitutional Council

The constitutional Council has jurisdiction to adjucate legislative and executive acts insofar they are contrary to the body of constitutional rules and principles. There are two kinds of procedure : one is before the adoption of the act, the other one is in the event where a question for constitutionality is raised during a dispute ( the "question prioritaire de constitutionnalité"). The conditions and limits to these procedures are laid down in the Code of Administrative Justice and the Constitution of 1958.