FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
• Notification to data subjects: If the breach poses a “high risk” to individuals (eg, risk of identity theft, fraud or discrimination), the controller must com - municate the breach to the data subjects without undue delay, providing clear advice on how to protect themselves (Article 34 GDPR). • Additional actions: Controllers will often also con - sider filing a criminal complaint and notifying their cyber-insurance provider (typically also within 72 hours). • Documentation: All breaches, including those not notified to the CNIL, must be recorded in an internal breach register, detailing the facts, effects and remedial actions taken. This register is often one of the first documents requested during a CNIL inspection. Recent enforcement actions, such as the EUR5 mil - lion fine against France Travail in 2024 and the EUR45 million fine against the internet access provider FREE in 2025 following massive data leaks, underscore the CNIL’s intolerance for failures in basic security hygiene and breach response. 1.7 Regulators France employs a multi-regulator model for the digital space, requiring organisations to navigate overlapping jurisdictions. French Data Protection Authority The CNIL acts as the French guardian of data privacy. Its missions and powers include: • Standards and guidelines – it develops frameworks for sectors like AI, health data, and cookies. While technically “advisory”, these are treated as authori - tative by the courts. • Public awareness – it provides educational resources and tools (templates, checklists) for the public and small businesses. • Investigative procedures – investigations are trig - gered either by individual complaints (approximate - ly 4,000/year) or self-initiated audits by the CNIL. • Enforcement powers – the CNIL has broad legal authority to ensure compliance, including by issu - ing administrative fines (up to EUR20 million or 4% of the worldwide annual turnover, whichever is
higher), public reprimands or injunctions, or revok - ing certifications. The CNIL operates within a network of regulators: • Domestic – it notably co-ordinates with ANSSI (cybersecurity), the ACPR (finance), and the ARCEP (telecoms). • International – as a member of the European Data Protection Board (EDPB), it works with other EU authorities to ensure consistent application of the GDPR across borders. Sectoral Authorities • ANSSI (the National Cybersecurity Agency of France) is the authority dealing with cyber-defence and resilience. It enforces the NIS Directive and certifies security products (eg, SecNumCloud). ANSSI focuses on technical standards and critical infrastructure protection. • ARCEP ( Autorité de Régulation des Communica- tions Électroniques, des Postes et de la Distribution de la Presse ) has been empowered by the SREN Law and the Data Governance Act to regulate data intermediation services and the cloud computing market (specifically regarding switching and inter - operability). • ARCOM ( Autorité de régulation de la communica- tion audiovisuelle et numérique ) acts as the digital services co-ordinator for France under the Digital Services Act (DSA) and oversees certain aspects of platform regulation, particularly regarding the protection of minors online. • The DGCCRF ( Direction générale de la concur- rence, de la consommation et de la répression des fraudes ) is the Directorate General for Competi - tion, Consumer Affairs and Fraud Control, which focuses on consumer protection aspects of digital platforms, including dark patterns and transpar - ency in online marketplaces. • The ACPR ( Autorité de contrôle prudentiel et de résolution ) is the French Prudential Supervision and Resolution Authority, which supervises finan - cial institutions and addresses data protection and cybersecurity standards alongside financial regula - tion. • The ANSM ( L’Agence nationale de sécurité du médicament et des produits de santé ) is the
118 CHAMBERS.COM
Powered by FlippingBook