Law on Computers and Liberties (1978)

Law on Computers and Liberties (1978)
Name	Law on Computers and Liberties
Enacted	1978
Jurisdiction	France
Citation	Law No. 78-17
Introduced by	Raymond Marcellin
Administered by	Commission nationale de l'informatique et des libertés
Status	amended

Law on Computers and Liberties (1978) is a French statute enacted as Law No. 78-17 that established foundational rules for personal data processing, privacy safeguards, and regulatory supervision in the context of automated information systems. The law emerged amid technological, political, and social debates involving Georges Pompidou, Valéry Giscard d'Estaing, Raymond Barre, François Mitterrand, and legislative actors on the French National Assembly and Senate (France), and it anticipated later European instruments such as the Data Protection Directive 95/46/EC and the General Data Protection Regulation. The statute created a compliance regime and an independent supervisory authority to balance individual rights with public and private sector interests represented by entities like Électricité de France, SNCF, Crédit Lyonnais, and cultural institutions including the Bibliothèque nationale de France.

Background and Legislative Context

The statute was developed in the milieu of technological modernization initiatives linked to projects by IBM, Bull (company), Thomson (company), and research agendas at Centre national de la recherche scientifique and Institut national de la statistique et des études économiques; debates spanned parliamentary committees in the Assemblée nationale (France) and policy circles around Christian Bonnet, Raymond Marcellin, and advisors in the Élysée Palace. Comparative influences included jurisprudence from the European Court of Human Rights, legislative models like the United States Federal Trade Commission practices, and academic commentary from scholars associated with École normale supérieure and Université Paris I Panthéon-Sorbonne. Public controversies involved business actors such as Dassault, press outlets like Le Monde, civil liberties groups inspired by thinkers in the tradition of René Cassin and organizations akin to Reporters Without Borders. Internationally, diplomatic exchanges with Council of Europe representatives and technical standards dialogues with International Organization for Standardization informed the bill's provisions.

Key Provisions and Principles

The law enumerated procedural and substantive rules governing automated processing of personal data, including principles of lawful purpose, proportionality, accuracy, and security articulated alongside rights of access, rectification, and erasure reminiscent of protections in the European Convention on Human Rights and later echoing in the Charter of Fundamental Rights of the European Union. It prescribed notification and registration requirements similar to administrative regimes overseen by entities like Commission européenne and imposed constraints affecting public administrations such as Ministry of the Interior (France) databases, social bodies including Caisse nationale d'assurance vieillesse, and private firms like Banque de France. Sanctions and remedies referenced civil liability norms from precedents like rulings of the Conseil d'État (France) and the Cour de cassation. The statute also delineated exemptions for law enforcement and national security matters involving agencies such as Direction générale de la Sécurité extérieure and Direction centrale de la Police judiciaire.

Institutional Framework and CNIL

The law established the Commission nationale de l'informatique et des libertés (CNIL), an independent administrative authority modeled in conversation with oversight bodies including the Commission nationale consultative des droits de l'homme, the Conseil constitutionnel, and regulatory agencies seen in systems like the Office of the United Nations High Commissioner for Human Rights. CNIL's mandate covered registration of automated files, enforcement powers, guidance for organizations such as Assurance Maladie, Ministry of Justice (France), and municipal bodies including Mairie de Paris, and cooperation with international counterparts like the Information Commissioner's Office and data protection authorities within the European Data Protection Board. Governance structures referenced pluralistic appointments drawn from offices like the Conseil d'État and the Cour des comptes, and CNIL issued guidance affecting technology vendors such as Microsoft and research programs at Université Pierre et Marie Curie.

Impact on Data Protection Practices

The statute catalyzed changes across sectors: financial institutions including Société Générale reengineered customer recordkeeping, insurers like AXA adjusted underwriting data flows, healthcare providers associated with Assistance Publique – Hôpitaux de Paris modified patient systems, and media organizations including Agence France-Presse confronted new obligations. Academic research at Centre d'études et de recherches internationales and industry bodies like Medef debated compliance costs and innovation trade-offs, while civil society actors such as La Quadrature du Net and labor unions including Confédération générale du travail litigated perceived rights impacts. Internationally, the law influenced policy development in member states of the Organisation for Economic Co-operation and Development and informed multilateral instruments negotiated under the United Nations umbrella.

Legal Amendments and Subsequent Developments

Since 1978, the statute underwent amendments reacting to technological shifts driven by corporations like Google, Facebook, Amazon (company), and regulatory milestones such as the Data Protection Directive 95/46/EC, the Directive on Privacy and Electronic Communications, and the adoption of the General Data Protection Regulation. Revisions adjusted sanctioning powers, transborder data transfer rules vis-à-vis regimes like the Privacy Shield and mechanisms related to the European Court of Justice rulings in cases involving entities including Max Schrems and litigation against multinational platforms. Legislative updates incorporated compliance instruments familiar to professionals from Association Française des Correspondants à la Protection des Données à Caractère Personnel and harmonized French law with decisions from the Court of Justice of the European Union.

Criticisms, Controversies, and Litigation

Critiques emerged from stakeholders including multinational corporations such as Apple Inc., academic commentators at Sciences Po, and political actors in the Rassemblement pour la République, questioning impacts on competitiveness, administrative burden, and surveillance exceptions involving services like France Télévisions and security collaborations with agencies such as Direction générale de la Police nationale. Landmark cases and disputes before the Conseil d'État and the Cour de cassation addressed CNIL decisions, while transnational litigation involving plaintiffs like Max Schrems influenced interpretive contours and sparked debates in forums such as the European Parliament and among NGOs including Amnesty International. Ongoing controversies continue to juxtapose privacy advocacy with technological innovation led by firms headquartered in Silicon Valley and policy priorities of executive offices like the Matignon residence.

Category:French laws Category:Privacy law