FRANCE Law and Practice Contributed by: Jérôme Philippe, Laéna Bouafy, Thomas Retière and Annabelle Hamelin, Freshfields
Postal and Electronic Communications Code. Arcep may initiate proceedings and, if necessary, impose sanctions on the operators concerned. Arcom The Regulatory Authority for Audiovisual and Digi - tal Communication (Arcom) is the national authority responsible for regulating audiovisual media, digital platforms and online content in France. It notably works to protect freedom of speech in the public inter - est, while monitoring the security obligations imposed on online public communication service publishers and video-sharing platform service providers with regards to online protection of minors. Arcom also holds extensive sanctioning powers, allowing it to impose measures such as suspending programmes or services, reducing or withdrawing broadcasting authorisations, and ordering the publication of cor - rective statements. Arcom is one of the regulators empowered with the enforcement of the AI Act in France. DGCCRF The General Directorate for Competition, Consum - er Affairs and Fraud Control (DGCCRF), which is a department within the French Ministry of the Econ - omy, is inter alia in charge of consumer protection. As such, it may be involved in privacy investigations, platforms regulation, payment security and generally all frauds affecting consumers. The DGCCRF is one of the regulators empowered with the enforcement of the AI Act in France, and is the co-ordinator of all the regulators involved in that field in France. Across critical sectors such as banking and health, cybersecurity oversight is ensured by dedicated national authorities such as the following. ACPR The French Prudential Supervision and Resolution Authority (ACPR), attached to the Banque de France, is the administrative authority responsible for super - vising the banking and insurance sectors. It aims at ensuring financial stability, protecting customers, and combating money laundering and terrorist financing. As part of its oversight of banks and insurers, the ACPR monitors emerging risks, including cyber-risk. The ACPR conducts on‑site and off‑site inspections,
applies a wide range of supervisory and sanctioning measures, and exercises resolution powers to safe - guard financial stability. The ACPR is one of the regu - lators empowered with the enforcement of the AI Act in France. AMF The French Financial Markets Authority (AMF) is the independent public body responsible for regulating France’s financial markets. It supervises market par - ticipants, including asset management companies, investment firms and listed companies. Its primary missions are to ensure investor protection, promote orderly markets and provide information to the public. With the implementation of DORA, the AMF’s remit has been explicitly extended to oversee the digital and cyber-resilience of the financial entities under its supervision. ANS The French Digital Health Agency (ANS), under the authority of the Ministry of Health, is responsible for strengthening the security of health information systems in France. It operates the CERT Santé, the dedicated Computer Emergency Response Team for the healthcare sector. Specifically, the CERT Santé supports healthcare and medico‑social organisations in responding to information‑system security inci - dents by providing prevention, alerts and essential cyber‑risk guidance. In addition, the ANS oversees compliance with key data-security requirements for healthcare providers, including monitoring adherence to the Health Data Hosting (HDS) certification scheme. 2. Critical Infrastructure Cybersecurity Regulation 2.1 Scope of Critical Infrastructure Cybersecurity Regulation Essential and Important Entities Legislative framework The primary legislative framework governing cyber - security for essential or critical entities in France is currently established by the 2018 Security Law, which transposes the original NIS Directive, along -
124 CHAMBERS.COM
Powered by FlippingBook