FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
ing must designate an independent, qualified DPO who reports directly to senior management. • Document compliance. 1.3 Special Categories of Personal Data Prohibition on Processing Special Categories of Personal Data Under Article 9 GDPR, processing of special catego - ries of personal data (including data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, and genetic, biometric, or health data) is prohibited unless a specific derogation applies. Derogations include, among other things: • obtaining the explicit consent of the data subject to the processing of such data; • specific obligations and rights in the fields of employment, social security, or social protection law; • protection of the vital interests of the data subject when they are physically or legally incapable of giv - ing consent; • preventative or occupational medicine, medical diagnosis, and the management of health or social care systems and services – generally under the responsibility of a professional subject to confiden - tiality obligations; • public interest in the field of public health, eg, monitoring epidemics; and • archiving in the public interest, for scientific or his - torical research purposes, or statistical purposes, subject to appropriate safeguards. Specific hosting requirement for health data Where health data is hosted for care-related activities, French law requires use of a certified host (“Health Data Hosting Provider” – Article L 1111‑8 of the Public Health Code), with contractual constraints. Processing data related to criminal convictions Personal data related to criminal convictions is not among the special categories where processing is pro - hibited by principle under Article 9 of the GDPR. How - ever, it is also subject to specific rules. Under Article 46 of the FDPA (implementing Article 10 GDPR), pro - cessing data regarding criminal convictions is largely a
state monopoly, reserved for courts and public author - ities. Private entities are strictly limited in their ability to process such data. Employers, for example, can - not conduct blanket criminal background checks; they may only request a criminal record extract (Bulletin No 3) if it is strictly necessary for the job and authorised by law (eg, for security personnel or employees work - ing with minors). Protecting minors’ data Following the GDPR, the age of digital consent for the processing of personal data in France is 15, meaning that children under 15 cannot validly consent to the processing of their data by online services without parental authorisation. Organisations must implement proportionate age verification or parental consent mechanisms and ensure that data collection remains strictly necessary. More broadly, the protection of minors is a crucial and highly topical issue in France. At the time of writing, parliamentary debates are underway regarding a proposed ban on social media for those under the age of 15. 1.4 Processing of Personal Data for Research and Development Purposes Scientific Research (Including Health Research, Studies and Evaluations) The GDPR recognises a research-oriented regime: further processing for scientific research is, subject to Article 89 safeguards, not considered incompatible with the initial purpose (Article 5 (1)(b)), and member state law may allow limited derogations from certain data-subject rights where necessary and proportion - ate. To process health data (see 1.3 Special Categories of Personal Data ), controllers commonly rely on the scientific research ground (Article 9 (2)(j)) coupled with Article 89 safeguards. France adds a specific gatekeeping layer for health- sector “research/study/evaluation” processing: such processing must pursue a public-interest purpose and either comply with a CNIL reference methodol - ogy (in which case, it can proceed after filing a simple declaration of compliance) or have obtained specific authorisation from the CNIL.
115 CHAMBERS.COM
Powered by FlippingBook