FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
1.2 Rights and Obligations General Principles for Personal Data Processing The processing of personal data in France is governed by foundational principles established in the GDPR and reflected in the FDPA. These principles consti - tute the normative framework within which all data processing must occur. • Lawfulness, fairness and transparency: All pro - cessing must be lawful, fair, and transparent. Lawfulness requires a valid legal basis under GDPR Article 6 (or FDPA Article L 13-13), which includes consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. Fairness requires that processing must be carried out honestly and without deception. Transparency mandates providing clear information to data sub - jects regarding the main aspects of processing. • Purpose limitation: Personal data may be pro - cessed only for specified, explicit and legitimate purposes. Any use beyond the original purpose requires a compatibility assessment or a new legal basis. • Data minimisation: Only personal data that is adequate, relevant, and strictly necessary for the specified purposes may be collected and pro - cessed. • Accuracy: Personal data must be accurate and kept up to date, with reasonable measures taken to rectify or delete inaccurate data. • Storage limitation: Personal data must be kept only as long as necessary for the processing purpose. • Security: Personal data must be processed secure - ly and protected against unauthorised access, alteration, loss or destruction through appropriate technical and organisational measures. • Accountability: Data controllers must demonstrate compliance with all principles through documenta - tion, records, impact assessments, and govern - ance structures. Data Subject Rights The GDPR grants individuals a broad set of enforce - able rights over their personal data. These include the right to access and obtain information about how their data is processed, to rectify inaccurate data, and, where legally justified, to request erasure. Data sub - jects may also restrict processing, receive their data in
a portable and machine-readable format, and object to certain types of processing, including marketing or processing based on legitimate interests or public tasks. In addition, they are protected against purely automated decision-making, with the right to seek explanations and human review, and they may lodge complaints with a supervisory authority free of charge. The FDPA adds a specific data subject right, linked to digital death: Article 85 of the FDPA allows individuals to define general or specific directives concerning the storage, erasure and communication of their personal data after their death. Organisational Compliance: Essential Checklist • Apply privacy by design/default: Embed data pro - tection principles from the design phase of prod - ucts or services. • Establish a legal basis: Identify and document a valid legal basis (GDPR Article 6) for each process - ing purpose and reassess when purposes or condi - tions change. • Define retention and deletion rules: Establish struc - tured retention periods and ensure systematic, preferably automated deletion backed by docu - mented reviews. • Ensure adequate security measures: Implement technical and organisational safeguards appro - priate to processing risks, including encryption, access controls, testing, and incident response plans. • Provide transparent information: Supply complete privacy information at collection (at first contact or within one month when collection is indirect), covering all mandatory items listed under Article 13 (direct collection) or 14 (indirect collection) of the GDPR. • Enable data subject rights: Set up practical pro - cesses to exercise rights easily, ensuring effective access, objection, deletion, restriction, etc. • Manage third-party processing: Contractually define data protection obligations when working with external processors or controllers. • Conduct data protection impact assessments (DPIAs): For high-risk processing, perform DPIAs outlining risks and mitigation measures. • Appoint a data protection officer (DPO): Organisa - tions that do extensive or sensitive data process -
114 CHAMBERS.COM
Powered by FlippingBook