Commission Nationale de l'Informatique et des Libertés

Commission Nationale de l'Informatique et des Libertés is an independent French administrative regulatory body tasked with ensuring data privacy. It was established in the wake of public concern following the SAFARI project, a controversial government plan to create a centralized national database. The agency's foundational legal framework is the Data Protection Act 1978, inspired by earlier work from the National Assembly (France) and recommendations from a parliamentary commission led by Bernard Tricot. As the national data protection authority for France, it plays a critical role in enforcing the General Data Protection Regulation within its jurisdiction.

History and establishment

The genesis of the commission can be traced to growing societal anxiety over computerized data collection in the early 1970s. A pivotal moment was the public revelation of the SAFARI project by the newspaper Le Monde in 1974, which sparked widespread debate. In response, the Government of France under President Valéry Giscard d'Estaing established a study commission, which recommended creating an independent supervisory authority. This led to the adoption of the landmark Data Protection Act 1978, formally establishing the body on January 6, 1978. The law was significantly influenced by the pioneering work of the Conseil d'État and the advocacy of figures like Senator Jacques Thyraud, who emphasized the need to protect civil liberties in the digital age.

Organization and structure

The commission is composed of a college of 18 members, representing a diverse array of French institutions. This includes four members from the Assemblée Nationale and the Sénat, two from the Conseil économique, social et environnemental, and six representatives from high judicial bodies like the Cour de cassation and the Conseil d'État. It is led by a President and a Vice-President, who are elected by the college from among its members. The agency's operational work is carried out by a permanent secretariat general, divided into departments specializing in legal affairs, technology, European and international affairs, and communication. Its headquarters are located in the 11th arrondissement of Paris.

Powers and responsibilities

The agency possesses a broad mandate to regulate data processing across the public and private sectors. Its core powers include investigating complaints, conducting on-site and online inspections, and issuing authorizations for sensitive data processing. It can impose substantial administrative fines, order compliance with data protection rules, and in severe cases, halt processing operations. A key responsibility is providing guidance and approving codes of conduct for sectors like healthcare and finance. It also maintains a public register of data processing activities and advises the Government of France and the French Parliament on legislative and regulatory projects related to privacy and information technology.

Key rulings and enforcement actions

The commission has been active in enforcing regulations against major technology firms and public entities. Notable actions include a €50 million fine against Google in 2019 for lack of transparency under the General Data Protection Regulation. It has also sanctioned companies like Facebook, Amazon, and Microsoft for various violations concerning cookies and data transfers. In the public sector, it has ruled against the Ministry of the Interior (France) regarding the use of drones and facial recognition. The agency played a significant role in invalidating the EU-US Privacy Shield framework through its decisive action in the Schrems II case, which was ultimately adjudicated by the Court of Justice of the European Union.

International role and cooperation

As the lead data protection authority for many global technology companies operating in Europe, the agency holds a prominent position within the European Data Protection Board. It actively participates in the Global Privacy Assembly and cooperates with other national regulators like the Information Commissioner's Office in the United Kingdom and the Federal Trade Commission in the United States. The commission is integral to the Organisation for Economic Co-operation and Development's work on privacy guidelines and contributes to negotiations on international data transfer frameworks. It also works closely with institutions such as the Council of Europe regarding the Convention 108 treaty, which sets global standards for data protection.

Category:Data protection authorities Category:Government agencies established in 1978 Category:Organisations based in Paris