FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
National Agency for the Safety of Medicines and Health Products. It oversees medical device manu - facturers’ data protection compliance, particularly concerning patient data processing and device security. These authorities notably co-ordinate through a for - mal national network established by the SREN Law to ensure consistent application of the DSA. 1.8 Enforcement Proceedings and Fines Investigation Initiation and Procedures The CNIL generally initiates investigations based on complaints, external reports, data breach notifi - cations, or on its own initiative when it identifies a sensitive risk area or sector. It may investigate any controller or processor through unannounced on-site inspections, document-based reviews, hearings, or online checks of websites and services. During these investigations, the CNIL collects docu - ments, interviews staff and examines systems to assess compliance with the GDPR and the FDPA. An investigation can close with no further action, or the CNIL’s president may issue a formal notice ( mise en demeure ) giving the organisation a deadline within which to comply. This notice is not a sanction but a warning phase. If breaches are serious, persistent or unresolved, the president may – whether or not a prior notice was issued – refer the case to the CNIL’s sanctions committee ( formation restreinte ), which is responsible for imposing sanctions. Once referred, a formal sanctions procedure begins: the president appoints a rapporteur, who exchanges written submissions with the organisation and may hold a hearing. The case is then transmitted to the sanctions committee for an adversarial decision. The CNIL has no power to settle cases. Sanctions imposed by the panel are immediately enforceable, and fines are paid to the French Treasury (meaning they do not finance the CNIL). Decisions can be appealed before the Conseil d’État. For less serious cases, a simplified procedure allows the president of the sanctions committee or a desig - nated member to decide alone, without a public hear -
ing, with lower maximum fines (up to EUR20,000) and limited publicity – enabling the CNIL to handle a higher volume of straightforward infringements. Available Sanctions and Remedies Administrative sanctions • Warnings: Formal notice of non-compliance with - out financial penalties, typically for minor violations or first-time offences where organisations demon - strate rapid remediation. • Injunctions to cease processing: Orders requir - ing organisations to halt specific data processing within defined timeframes. • Interim injunctions with daily penalties: Injunctions compelling specific corrective actions (to imple - ment data protection policies, delete unlawful data or implement security measures) with daily penalty assessments (up to EUR100,000 per day) for non- compliance. • Administrative fines: Monetary penalties up to EUR20 million or 4% of the annual worldwide turnover (whichever is higher) pursuant to GDPR Article 83. • Certification revocation: Where organisations hold CNIL certifications, the CNIL may revoke these, effectively prohibiting certification-dependent activities. • Public disclosure: CNIL decisions, particularly those imposing significant fines, are typically published (sometimes, but seldom, in anonymised form). Civil remedies Beyond CNIL administrative sanctions, data subjects may pursue civil damages before the French judicial courts (pursuant to GDPR Article 82). Criminal sanctions Serious data protection violations may trigger crimi - nal sanctions under the French Criminal Code, which criminalises, among other things: • failure to implement security measures (Article 226- 17); • the processing of special categories of personal data without legal basis (Article 226-19); or • failure to notify personal data violations (Article 226-17-1).
119 CHAMBERS.COM
Powered by FlippingBook