FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
1.6 Data Breach Requirement Under Article 33 of the GDPR, data controllers must notify the competent data protection authority of any personal data breach not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. In France, this notification is typically done via CNIL’s dedicated online portal. Furthermore, if the breach is likely to result in a high risk to the rights and freedoms of a natural person, Article 34 of the GDPR imposes controllers to communicate the per - sonal data breach to the data subject “without undue delay”. Cross-Reporting In France, the notification landscape in case of a security incident is fragmented. For example, where an entity is subject to the NIS framework, it must separately notify ANSSI of significant cyber-incidents. For financial entities, the EU Digital Operational Resil - ience Act (DORA) requires the notification of major ICT-related incidents to the “competent authority”. In France, depending on the type of financial entity con - cerned, this will generally be the Autorité de contrôle prudentiel et de résolution (ACPR) and/or the Autorité des marchés financiers (AMF). At the time of writing, the European Commission has proposed, as part of a digital regulatory simplification initiative (often referred to as the “Digital Omnibus”), the creation of a single reporting entry point intended to streamline notifica - tions under several EU digital frameworks (including NIS2, the GDPR and DORA). This remains a legislative proposal and is not yet in force. Action Items for Organisations • Immediate assessment: Upon detection, the organisation must assess the nature of the breach, the categories of data (eg, sensitive v non-sensi - tive), the volume of data subjects affected, and the likely consequences. The goal is to assess the level of risk for data subjects (and thus what notification obligations apply) and determine the remediation measures that must be implemented to contain the incident and avoid its repetition. • Notify the CNIL (unless risks for data subjects are unlikely): Submit breach notification to the CNIL within 72 hours via the online portal, with sufficient specificity.
CNIL’s AI Guidance The CNIL has positioned itself as a key AI regulator by issuing guidance in 2024–2025 on how the GDPR applies to AI systems. Its recommendations address core issues such as choosing a lawful basis, comply - ing with data minimisation and transparency princi - ples, conducting DPIAs, managing data subject rights, securing AI development, mitigating bias, and ensur - ing proper documentation and accountability, thereby promoting a risk-based and integrated compliance approach. Overlay of the EU AI Act The AI Act (Regulation (EU) 2024/1689) establishes a risk-based compliance framework distinct from, but complementary to, EU data protection law. It intro - duces prohibitions, transparency duties, and exten - sive obligations for high-risk AI systems and certain general-purpose models. Application is being phased in between 2025 and 2027 (prohibitions from February 2025; general-purpose model obligations from August 2025). It does not affect the GDPR (Article 2 (7)). • Transparency: Providers of high-risk systems must prepare technical documentation (Article 11) and clear instructions for use enabling risk assessment and mitigation (Article 13), including, where rel - evant, a DPIA (Article 26 (9)). Specific information duties apply towards individuals, eg, disclosure of AI interaction or synthetic/deepfake content (Arti - cles 50, 26 (11)). • Data governance: High-risk system providers must implement documented governance for training, validation, and testing data, ensuring relevance, representativeness, quality, traceability, and bias mitigation. Limited processing of special catego - ries of data is permitted strictly for bias monitoring under enhanced safeguards (Article 10). • Human oversight: High-risk systems must enable effective human control (interpretation, override, interruption, disregard of outputs) (Article 14). Deployers must assign oversight to competent persons with appropriate authority (Article 26 (2)), reinforcing fundamental-rights safeguards, includ - ing data protection.
117 CHAMBERS.COM
Powered by FlippingBook