Loi Informatique et Libertés

Loi Informatique et Libertés
Name	Loi Informatique et Libertés
Enacted	1978
Jurisdiction	France
Status	current

Loi Informatique et Libertés is a French statute enacted in 1978 to regulate personal data processing and protect individual liberties. It was promulgated in the context of technological advances after the Watergate scandal, the development of ARPANET, and debates involving bodies like the Council of Europe and the United Nations. The law has been revised to align with supranational instruments such as the General Data Protection Regulation and to interact with national institutions including the Conseil d'État and the Assemblée nationale.

History

The act was proposed amid public concerns following events like the Watergate scandal, legislative initiatives in the United Kingdom and scholarly work at institutions such as the Collège de France and the École nationale d'administration. Key figures in its passage included members of the Assemblée nationale and the Sénat, while advisory input came from entities like the Institut national de la statistique et des études économiques and the Comité consultatif national d'éthique. Subsequent amendments responded to rulings of the European Court of Justice, directives from the European Commission, and the adoption of the General Data Protection Regulation prompted consultations with the Conseil constitutionnel and debates in the Palais Bourbon.

Scope and Definitions

The statute defines processing operations relevant to administrations such as the Ministry of the Interior, healthcare actors like Assistance Publique – Hôpitaux de Paris, and private actors including Orange S.A. and BNP Paribas. It establishes terms comparable to those in instruments from the Council of Europe and the European Union, distinguishing categories handled by entities like the RATP Group and cultural bodies such as the Bibliothèque nationale de France. Definitions intersect with jurisprudence from the Cour de cassation and interpretative guidance by the Conseil d'État, and they account for technologies developed by organizations like Thales Group and Capgemini.

Main Provisions

Provisions address registrations historically mirroring systems used by the Directorate-General for External Security, rights resembling frameworks in the Charter of Fundamental Rights of the European Union, and obligations for controllers analogous to policies at Société Générale and Carrefour. The law prescribes safeguards affecting sectors from Université Paris-Sorbonne research to operations at Aéroport de Paris, and it outlines interoperability expectations relevant to standards from the International Organization for Standardization and rulings by the European Court of Human Rights.

Rights of Data Subjects

Data subjects are afforded rights that echo protections defended in cases before the Cour de justice de l'Union européenne and referenced in reports by the Défenseur des droits. These rights affect individuals interacting with services of institutions such as CNRS, Assurance Maladie, and private platforms like Facebook and Google. Remedies and access mechanisms resemble procedures used in disputes involving entities like the Société Nationale des Chemins de fer Français and adjudications by the Tribunal administratif de Paris.

Supervisory Authority (CNIL)

The supervisory authority created under the statute, the Commission nationale de l'informatique et des libertés, performs functions comparable to European counterparts such as the Information Commissioner's Office and cooperates with bodies including the European Data Protection Board and national agencies like the Bundesbeauftragter für den Datenschutz. CNIL issues guidance impacting sectors served by EDF and La Poste and engages in enforcement actions similar to those undertaken by regulators such as the Autorité des marchés financiers.

Enforcement and Sanctions

Enforcement mechanisms include administrative measures and fines analogous to sanctions applied by the European Commission and decisions enforced by the Conseil d'État. Sanctions have been imposed in contexts involving corporations like Amazon (company), Apple Inc., and telecom operators akin to SFR. Criminal provisions intersect with procedures in courts such as the Cour d'appel de Paris and can lead to litigation before international forums including the European Court of Human Rights.

Impact and Criticism

The statute influenced regulatory frameworks adopted by states like Germany, Spain, and Italy, and it shaped debates involving think tanks such as Institut Montaigne and academic centers at Sciences Po. Critics cite tensions highlighted by litigants including civil society groups like La Quadrature du Net and professional associations such as the Association Française des Correspondants à la Protection des Données à Caractère Personnel, pointing to challenges in reconciling commercial practices of firms like Airbnb and technological developments from Microsoft with protections championed by the Conseil constitutionnel and overseen by the Cour de cassation.

Category:Law of France Category:Privacy law