Data Protection in France: Difference between revisions

From GDPRhub
(Correcting typo (dwon => down))
 
(5 intermediate revisions by 3 users not shown)
Line 22: Line 22:
==Legislation==
==Legislation==
===History===
===History===
The French government enacted its first data protection act in 1978, the ''Law n° 78-17 of 6 January 1978 relative à l'informatique, aux fichiers et aux libertés'', so-called law "[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 Informatique et Libertés]". Directive 95/46/ex has been transposed by the law n° 2004-801 du 6 août 2004 which modified the law "Informatique et Libertés.  
The French government enacted its first data protection act in 1978, the ''Law n° 78-17 of 6 January 1978 relative à l'informatique, aux fichiers et aux libertés'', so-called law "[https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 Informatique et Libertés]". Directive 95/46/ex was implemented by the law n° 2004-801 du 6 août 2004 which modified the law "Informatique et Libertés.  


===National constitutional protections===
===National constitutional protections===
The right to the protection of personal data falls within the scope of application of the right to the respect for private life. Indeed, it is acknowlegded that the right to respect for private life protects individual from interferance, such as the disclosure or publication of personal data (see, Cassation, Civ. 1, 5 Nov. 1996).  
The right to the protection of personal data falls within the scope of application of the right to respect for private life. Indeed, it is acknowlegded that the right to respect for private life protects individual from interferance, such as the disclosure or publication of personal data (see, Cassation, Civ. 1, 5 Nov. 1996).  


The right to the respect for private life has a constitutional value in France, in accordance with the Constiutional Council decision of July 1999 (see, Constitutionnel Council, [https://www.conseil-constitutionnel.fr/decision/1999/99416DC.htm decision n° 99-416 DC of 23 July 1999]). The Constitutional Council conferred to the right to the respect for private life a constitutional value as it is directly implied in Article 2 of the [https://www.conseil-constitutionnel.fr/sites/default/files/as/root/bank_mm/anglais/cst2.pdf Declaration of Human and civic rights of 1789], which forms part of the body of constitutional rules and principles by reference to which the Constitutionnal Council can adjudicate.
The right to the respect for private life has a constitutional value in France, in accordance with the Constiutional Council decision of July 1999 (see, Constitutionnel Council, [https://www.conseil-constitutionnel.fr/decision/1999/99416DC.htm decision n° 99-416 DC of 23 July 1999]). The Constitutional Council conferred to the right to respect for private life a constitutional value as it is directly implied in Article 2 of the [https://www.conseil-constitutionnel.fr/sites/default/files/as/root/bank_mm/anglais/cst2.pdf Declaration of Human and civic rights of 1789], which forms part of the body of constitutional rules and principles by reference to which the Constitutionnal Council can adjudicate.


===National GDPR implementation law===
===National GDPR implementation law===
Line 42: Line 42:


====Research====
====Research====
The specific rules related to a processing for archival purposes in the public interest, for scientific or historical research or for statistical purposes are laid dwon in Articles 78 and 79 of the Law "Informatique et Libertés".   
The specific rules related to a processing for archival purposes in the public interest, for scientific or historical research or for statistical purposes are laid down in Articles 78 and 79 of the Law "Informatique et Libertés".   


====Other relevant national provisions and laws====
====Other relevant national provisions and laws====
Line 50: Line 50:
The French government transposed the ePrivacy Directive by modifying several domestic laws. The Law "Informatique et Libertés" has been modified by the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000441676 n° 2004/801 of 6 August 2004], the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164 n° 575 of 21 June 2004] and the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000439399 n° 669 of 9 July 2004].  
The French government transposed the ePrivacy Directive by modifying several domestic laws. The Law "Informatique et Libertés" has been modified by the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000441676 n° 2004/801 of 6 August 2004], the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164 n° 575 of 21 June 2004] and the Law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000439399 n° 669 of 9 July 2004].  
==Data Protection Authority==
==Data Protection Authority==
===General information===
The French Data Protection Commission (''Commission Nationale de l’Informatique et des Libertés'') is the national data protection authority for France.
The French Data Protection Commission (''Commission Nationale de l’Informatique et des Libertés'') is the national data protection authority for France.


→ Profile: [[CNIL (France)]]
→ Profile: [[CNIL (France)]]
===Procedural information===
====Applicable Procedural Law====
The CNIL operates under the law "''Informatique et Libertés''" under the conditions laid down by Articles 19 to 29. See the law [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460 here], in French. The law "informatique et Libetés" has to be read jointly with the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038528420&fastPos=1&fastReqId=562981948&categorieLien=cid&oldAction=rechTexte Decree n° 2019-536 of May 29]. 
====Complaints Procedure under Art 77 GDPR====
According to [https://www.legifrance.gouv.fr/affichTexteArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000037822923&cidTexte=LEGITEXT000006068624&dateTexte=20200609 Article 8, par.2 d)] of the loi "''Informatique et Liberté''", a data subject or their representative(s) can lodge a complaint with the CNIL regarding an alleged infringment of the GDPR.
According to Article 10 of the Decree n°2019-536,  the complaint will be deemed  rejected if the CNIL did not reach the author of the complaint within a three months period, regarding its complaint - whatever the means-.
====''Ex Officio'' Procedures under Art 57 GDPR====
The CNIL can run ''ex officio'' procedures out of its own motion. Its powers are described under [https://www.legifrance.gouv.fr/affichTexteArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000037822923&cidTexte=LEGITEXT000006068624&dateTexte=20200609 Article 8] of the law "''Informatique et Libertés''".
==Judicial protection==
==Judicial protection==
===Civil Courts===
===Civil Courts===
Line 73: Line 58:


===Administrative Courts===
===Administrative Courts===
The Administrative Courts have jurisdiction depending on the issue at stake, as clarified criteria determined and applied by the Court of Conflict (the "Tribunal des conflits").   
The Administrative Courts have jurisdiction depending on the issue at stake, and it is determined by the Court of Conflict (the "T''ribunal des conflits''").   
 
<u>The criteria are mainly established by case-law</u>. In this regard, the most important decision is the [https://www.conseil-constitutionnel.fr/decision/1987/86224DC.htm Decision n°86-224 DC from 23 January 1987], where the Constitutional Coucil held that "''the annulment or reversal of decisions taken, in the exercise of the prerogatives of public authority, by the authorities exercising executive power, their agents, the territorial communities of the Republic or public bodies placed under their authority or control'';" falls under the jurisidiction of the Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows interrupted video surveillance over a public area. It is also well estbablished that administrartive courts are competent for issues concerning public works, administrative public services, public domains, public servants, etc..


<u>The criteriae can also be prescribed by law.</u>  
<u>The criteria are mainly established by case-law</u>. In this regard, the most important decision is the [https://www.conseil-constitutionnel.fr/decision/1987/86224DC.htm Decision n°86-224 DC from 23 January 1987], where the Constitutional Council held that "''the annulment or reversal of decisions taken, in the exercise of the prerogatives of public authority, by the authorities exercising executive power, their agents, the territorial communities of the Republic or public bodies placed under their authority or control'';" falls under the jurisdiction of the Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows uninterrupted video surveillance covering a public area. It is also well established that Administrative Courts are competent for issues concerning public works, administrative public services, public domains, public servants, etc..


The Supreme administrative Court (the "''Conseil d'Etat''") is the first and last judicial intance before which the CNIL's decisions are challenged, pursuant to Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000027849762&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 311-1, par. 4] of the Code of Administrative Justice. Any CNIL's decision can be challenged with the conditions and limits provided for in the Code of Administrative Justice. More precisely, other admissibility requirements can be found below:
<u>The criteria can also be prescribed by law.</u> The Supreme administrative Court (the "''Conseil d'Etat''") is the first and last judicial instance before which the CNIL's decisions are challenged, pursuant to Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idArticle=LEGIARTI000027849762&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 311-1, par. 4] of the Code of Administrative Justice. Any CNIL's decision can be challenged with the conditions and limits provided for in the Code of Administrative Justice. More precisely, admissibility requirements can be found below:


'''Regarding the decision''' : it can be the lack of response or the notification of the CNIL's decision to the data subject
'''Regarding the decision''': it can be the lack of response or the notification of the CNIL's decision to the data subject


*the data subject can challenge within the two months following the notification of the decision according to Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006136478&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 421-1 to R 421-7] of the Code of Administrative Justice or within a three months period in the event where the CNIL did not issue a decision, pursuant to Article 10 of the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038528420&fastPos=1&fastReqId=562981948&categorieLien=cid&oldAction=rechTexte Decree n° 2019-536 of May 29].  
*the data subject can challenge within the two months following the notification of the decision according to Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006136478&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 421-1 to R 421-7] of the Code of Administrative Justice or within a three months period in the event where the CNIL did not issue a decision, pursuant to Article 10 of the [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038528420&fastPos=1&fastReqId=562981948&categorieLien=cid&oldAction=rechTexte Decree n° 2019-536 of May 29].


*The motion to institute proceedings must be presented to the ''Conseil d'Etat'' under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do?idArticle=LEGIARTI000006449919&idSectionTA=LEGISCTA000006150450&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 411-1 to R 411-6],
*The motion to institute proceedings must be presented to the ''Conseil d'Etat'' under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do?idArticle=LEGIARTI000006449919&idSectionTA=LEGISCTA000006150450&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 411-1 to R 411-6] of the Code of Administrative Justice,
*The motion has to be sent jointly with the decision at stake according to [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150451&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 412-1 and R 412-2],
*The motion has to be sent jointly with the disputed decision according to [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150451&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 412-1 and R 412-2] of the same code,
*it has to be filed with the Registry under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150452&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 413-1 to R 413-6] or transmitted elecronically by virtue of Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000026829513&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 414-1 to R 414-5]
*it has to be filed with the Registry under the conditions set out in Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000006150452&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 413-1 to R 413-6] or transmitted electronically by virtue of Articles [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?idSectionTA=LEGISCTA000026829513&cidTexte=LEGITEXT000006070933&dateTexte=20140101 R 414-1 to R 414-5] of the same code,


'''Regarding the data subject''': the data subject has to prove he/she has a legal standing, his/her legal interest, his/her legal capacity
'''Regarding the data subject''': the data subject has to prove he/she has a legal standing, his/her legal interest, his/her legal capacity


In addition to the proceeding described above before the ''Conseil d'Etat'', the Administrative Courts are also competent to issue interim decisions in a urgent situation, where there is a serious and manifestly unlawful infringement of fundamental freedoms, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449327&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-2] of the Code of Administrative Justice or where it exists a serous doubts as the legality of the decision, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449326&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-1] of the same code.  
In addition to the proceeding described above before the ''Conseil d'Etat'', the Administrative Courts are also competent to issue interim decisions in a urgent situation, where there is a serious and manifestly unlawful infringement of fundamental freedoms, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449327&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-2] of the Code of Administrative Justice or where it exists serious doubts as the legality of the decision, under Article [https://www.legifrance.gouv.fr/affichCodeArticle.do;jsessionid=853288BAD51E5DB090A44F727006FDCF.tplgfr38s_3?idArticle=LEGIARTI000006449326&cidTexte=LEGITEXT000006070933&dateTexte=20140101 L 521-1] of the same code. It can also apply to the CNIL decisions. 


You can find the all the provisions of the Code of Administrative Justice in French [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?cidTexte=LEGITEXT000006070933&dateTexte=20140101 here].
You can find the all the provisions of the Code of Administrative Justice in French [https://www.legifrance.gouv.fr/affichCode.do;jsessionid=A535D78A589B3AC331D1EB33E953F441.tplgfr38s_3?cidTexte=LEGITEXT000006070933&dateTexte=20140101 here].


===Constitutional Council===
===Constitutional Council===
The constitutional Council has jurisdiction to adjucate legislative and executive acts insofar they are contrary to the body of constitutional rules and principles. There are two kinds of procedure : one is before the adoption of the act, the other one is in the event where a question for constitutionality is raised during a dispute ( the "question prioritaire de constitutionnalité"). The conditions and limits to these procedures are laid down in the Code of Administrative Justice and the Constitution of 1958.
The constitutional Council has jurisdiction to adjucate legislative and executive acts insofar they are contrary to the body of constitutional rules and principles. There are two kinds of procedure : one is before the adoption of the act, the other one is in the event where a question for constitutionality is raised during a dispute ( the "''question prioritaire de constitutionnalité''"). The conditions and limits to these procedures are laid down in the Code of Administrative Justice and the Constitution of 1958.

Latest revision as of 09:37, 29 September 2021

Data Protection in France
Fr.png
Data Protection Authority: CNIL (France)
National Implementation Law (Original): Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés
English Translation of National Implementation Law: [n/a English Translation]
Official Language(s): French
National Legislation Database(s): Légifrance
English Legislation Database(s): n/a
National Decision Database(s): Link

Legislation

History

The French government enacted its first data protection act in 1978, the Law n° 78-17 of 6 January 1978 relative à l'informatique, aux fichiers et aux libertés, so-called law "Informatique et Libertés". Directive 95/46/ex was implemented by the law n° 2004-801 du 6 août 2004 which modified the law "Informatique et Libertés.

National constitutional protections

The right to the protection of personal data falls within the scope of application of the right to respect for private life. Indeed, it is acknowlegded that the right to respect for private life protects individual from interferance, such as the disclosure or publication of personal data (see, Cassation, Civ. 1, 5 Nov. 1996).

The right to the respect for private life has a constitutional value in France, in accordance with the Constiutional Council decision of July 1999 (see, Constitutionnel Council, decision n° 99-416 DC of 23 July 1999). The Constitutional Council conferred to the right to respect for private life a constitutional value as it is directly implied in Article 2 of the Declaration of Human and civic rights of 1789, which forms part of the body of constitutional rules and principles by reference to which the Constitutionnal Council can adjudicate.

National GDPR implementation law

In France the GDPR is implemented by the Law "Informatique et Libertés", as modified by the Loi n° 2018-493 of 20 June 2018 , the Decree n° 2018-687 of 1st August 2018 which has been enacted to implement the aforementionned Law and lastly, the Order n° 2018-1125 of 12 December 2018.

Age of consent

The age of consent is 15 years following Article 45 of the Law "Informatique et Libertés".

Freedom of Speech

The interplay between the right to the protection of personal data and the freedom of expression has been clarified by Article 80 of the Law "Informatique et Libertés".

Employment context

Article 44 of the Law "Informatique et Libertés" provides for a provisions which applies in employment context to the extent that it concerns the necessary processing of biometric data to the control of the access to the workplace and monitoring of apps and devices used during employees', interns', agents' tasks.

Research

The specific rules related to a processing for archival purposes in the public interest, for scientific or historical research or for statistical purposes are laid down in Articles 78 and 79 of the Law "Informatique et Libertés".

Other relevant national provisions and laws

The Law "Informatique et Libertés" gathers all the provisions related ot the processing of personal data. It includes cross references to other French laws such as labor law or criminal law.

National ePrivacy Law

The French government transposed the ePrivacy Directive by modifying several domestic laws. The Law "Informatique et Libertés" has been modified by the Law n° 2004/801 of 6 August 2004, the Law n° 575 of 21 June 2004 and the Law n° 669 of 9 July 2004.

Data Protection Authority

The French Data Protection Commission (Commission Nationale de l’Informatique et des Libertés) is the national data protection authority for France.

→ Profile: CNIL (France)

Judicial protection

Civil Courts

The Civil Courts have jurisdiction to address privacy rights' issues insofar it does not fall within the scope of competence of the Administrative Courts.

Administrative Courts

The Administrative Courts have jurisdiction depending on the issue at stake, and it is determined by the Court of Conflict (the "Tribunal des conflits").

The criteria are mainly established by case-law. In this regard, the most important decision is the Decision n°86-224 DC from 23 January 1987, where the Constitutional Council held that "the annulment or reversal of decisions taken, in the exercise of the prerogatives of public authority, by the authorities exercising executive power, their agents, the territorial communities of the Republic or public bodies placed under their authority or control;" falls under the jurisdiction of the Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows uninterrupted video surveillance covering a public area. It is also well established that Administrative Courts are competent for issues concerning public works, administrative public services, public domains, public servants, etc..

The criteria can also be prescribed by law. The Supreme administrative Court (the "Conseil d'Etat") is the first and last judicial instance before which the CNIL's decisions are challenged, pursuant to Article R 311-1, par. 4 of the Code of Administrative Justice. Any CNIL's decision can be challenged with the conditions and limits provided for in the Code of Administrative Justice. More precisely, admissibility requirements can be found below:

Regarding the decision: it can be the lack of response or the notification of the CNIL's decision to the data subject

  • the data subject can challenge within the two months following the notification of the decision according to Articles R 421-1 to R 421-7 of the Code of Administrative Justice or within a three months period in the event where the CNIL did not issue a decision, pursuant to Article 10 of the Decree n° 2019-536 of May 29.
  • The motion to institute proceedings must be presented to the Conseil d'Etat under the conditions set out in Articles R 411-1 to R 411-6 of the Code of Administrative Justice,
  • The motion has to be sent jointly with the disputed decision according to R 412-1 and R 412-2 of the same code,
  • it has to be filed with the Registry under the conditions set out in Articles R 413-1 to R 413-6 or transmitted electronically by virtue of Articles R 414-1 to R 414-5 of the same code,

Regarding the data subject: the data subject has to prove he/she has a legal standing, his/her legal interest, his/her legal capacity

In addition to the proceeding described above before the Conseil d'Etat, the Administrative Courts are also competent to issue interim decisions in a urgent situation, where there is a serious and manifestly unlawful infringement of fundamental freedoms, under Article L 521-2 of the Code of Administrative Justice or where it exists serious doubts as the legality of the decision, under Article L 521-1 of the same code. It can also apply to the CNIL decisions.

You can find the all the provisions of the Code of Administrative Justice in French here.

Constitutional Council

The constitutional Council has jurisdiction to adjucate legislative and executive acts insofar they are contrary to the body of constitutional rules and principles. There are two kinds of procedure : one is before the adoption of the act, the other one is in the event where a question for constitutionality is raised during a dispute ( the "question prioritaire de constitutionnalité"). The conditions and limits to these procedures are laid down in the Code of Administrative Justice and the Constitution of 1958.