FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws General Legal Framework France’s data protection and privacy landscape is built upon a two-tier regulatory structure combining European Union law with national legislation. The cor - nerstone of this framework is the General Data Protec - tion Regulation (Regulation (EU) 2016/679) (GDPR), which has been directly applicable since 25 May 2018, and serves as the primary legal instrument establish - ing minimum standards for data protection across all EU member states, including France. Under French domestic law, the main regulatory instrument for the protection of personal data is the French Data Pro - tection Act (FDPA) – known as “ Loi informatique et libertés ”, which was originally enacted on 6 January 1978 (Law No 78-17) and has been amended several times since. The interaction between the EU texts and the FDPA is hierarchical but complementary: the GDPR sets the harmonised standard, while the FDPA: • fills gaps left by the GDPR – for example, the FDPA contains rules on the fate of personal data after the death of the data subjects, which are expressly excluded from the GDPR’s scope; • introduces specific requirements and protection pursuant to the GDPR’s opening clauses – for example, the FDPA defines a specific regulatory framework to process health data in the context of research projects; • transposes the EU Law Enforcement Directive (2016/680), as well as the cookie provisions of the EU ePrivacy Directive (2002/58), into French Law; and • delineates the powers of the national regulator, the National Commission for Information Technol - ogy and Civil Liberties ( Commission Nationale de l’Informatique et des Libertés – CNIL). Sectoral Legal Instrument Sectoral instruments also play an important role. The Public Health Code ( Code de la santé publique ) con - tains particular provisions governing the processing of health data, including requirements for hosting certi -
fication (“HDS certification”). The Post and Electronic Communications Code ( Code des postes et des com- munications électroniques – CPCE) governs electronic marketing and the confidentiality of correspondence, transposing the ePrivacy Directive. Furthermore, the Labour Code ( Code du travail ) regulates employee monitoring, requiring proportionality and prior con - sultation with employee representative bodies. Extraterritorial Reach Both the GDPR and the FDPA have significant extra - territorial reach. Under GDPR Article 3, the regulation applies to organisations established in the EU, regard - less of where data processing occurs; and to organi - sations established outside the EU that offer goods or services to data subjects in the EU or monitor their behaviour. This territorial principle is reproduced in the FDPA. Regarding specifically the “opening provi - sions”, the FDPA states that French rules apply as long as the data subject resides in France, including when the data controller is not established in France. Interplay with Non-Personal Data, Cybersecurity, and AI Regulation France’s regulatory framework increasingly integrates data protection with rules on non-personal data, cybersecurity and AI. • The Data Act (Regulation (EU) 2024/1864), appli - cable from September 2025, governs data access and sharing – especially for IoT data – and overlaps with the GDPR where personal data is involved; France’s 2024 SREN Law ( Loi sur la Sécurité et Régulation des Espaces Numériques ) complements this by imposing interoperability and portability duties on cloud providers. • The French cybersecurity agency, ANSSI ( Agence nationale de la sécurité des systèmes d’information ) enforces NIS and NIS2 obligations, requiring incident notifications that may also trigger GDPR breach reporting to the CNIL. • The AI Act (Regulation (EU) 2024/1689), phased in until August 2027, applies cumulatively with the GDPR when AI systems process personal data, requiring organisations to comply simultaneously with both AI-specific and data protection require - ments.
113 CHAMBERS.COM
Powered by FlippingBook