CNIL (France)

From GDPRhub
Commission nationale de l'informatique et des libertés
LogoFR.png
Name: Commission nationale de l'informatique et des libertés
Abbreviation : CNIL
Jurisdiction: France
Head: Marie-Laure Denis
Secretary general: Jean Lessi
Adress: 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07
Webpage: cnil.fr
Fax: +33 1 53 73 22 00
Phone: +33 1 53 73 22 22
Twitter: @CNIL and @CNIL_en
Procedural Law: n/a
Decision Database: Legifrance
Translated Decisions: Category:CNIL (France)
Head Count: n/a
Budget: n/a

The CNIL is the federal Data Protection Authority for France. The authority is established in Paris and is in charge of enforcing GDPR for France.

Structure[edit | edit source]

The CNIL was established in 1978 with the law "Informatique et Libertés". It is an independent administrative authority led by a college of 18 members and a contract staff team. Twelve out of eighteen members are elected or designated by the national authorites and courts to which they belong (i.e. Senate, National Parliament, Economic and Social Committee, Supreme Civil and Administrative Courts, Court of Auditors and the Commission of Access to Administrative Documents). The CNIL's president can freely recruit its other staff.

The CNIL issues orders and imposes fines within a restricted formation, meaning one president and five others elected members, pursuant to Article 9 of the Law "Informatique et Libertés". The CNIL's internal rules indicate that, unless otherwise justified, the pronunciation of fines is public. Anyone can ask for the agenda of the hearing and attend.

The composition, nomination and the organisational structure is laid down by Articles 9 to 18 of the Law "Informatique et Libertés".

You can find the organizational chart here.

Procedural Information[edit | edit source]

Applicable Procedural Law[edit | edit source]

The CNIL operates under the law "Informatique et Libertés" under the conditions laid down by Articles 19 to 29.

Complaints Procedure under Art 77 GDPR[edit | edit source]

The Supreme administrative Court (the "Conseil d'Etat") is the first and last judicial intance before which the CNIL's decisions are challenged, pursuant to Article R 311-1 of the Code of Administrative Justice.

Any CNIL's decision can be challenged within the four months following the notification of the decision, with the conditions and limits provided for in Articles R 411-1 to R 421-7 and R 432-1 to R 441-1 of the Code of Administrative Justice.

You can find the provisions of the Code of Administrative Justice in French here.

Ex Officio Procedures under Art 57 GDPR[edit | edit source]

The CNIL can run ex officio procedures out of its own motion. Its powers are described under Article 8 of the law "Informatique et Libertés".

Practical Information[edit | edit source]

The CNIL provides an online service to submit a complaint (in French) here.

Statistics[edit | edit source]

You can help us filling this section!

EU/EEA's Data Protection Authorities
Austria · Belgium · Bulgaria · Croatia · Cyprus · Czech Republic · Denmark · Estonia · Finland · France · Germany (Brandenburg · Berlin · Baden-Württemberg · Bavaria · Bremen · Hesse · Hamburg · Mecklenburg-Vorpommern · Lower Saxony · North Rhine-Westphalia · Rhineland-Palatinate · Schleswig-Holstein · Saarland · Saxony · Saxony-Anhalt · Thuringia) · Greece · Hungary · Ireland · Italy · Latvia · Lithuania · Luxembourg · Malta · Netherlands · Poland · Portugal · Romania · Slovakia · Slovenia · Spain · Sweden · United Kingdom
Iceland · Liechtenstein · Norway EDPS · EDPB