FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
Scope and key mechanisms • Product data and related service data: users of connected products are granted access rights to data generated by their use of the product or related service, including necessary metadata. • B2B data sharing: data holders must make data available to third parties at the user’s request, sub - ject to safeguards (eg, trade secrets). • Public-sector access: public bodies may request data in cases of “exceptional need” under strict conditions. • Cloud switching and portability: providers of data processing services must remove unjustified switching barriers and enable portability of cus - tomers’ exportable data and digital assets. The regulation defines key roles, including users, data holders, data recipients, and, for cloud services, cus - tomers and providers of data processing services. It also references data intermediation services as defined in the Data Governance Act. French Context While the Data Act is EU-wide regulation, France has anticipated it with the “SREN” Law No 2024-449 of 21 May 2024 (Law to Secure and Regulate the Digital Space). The SREN Law establishes interoperability and portability obligations for cloud computing ser - vice providers, complementing Data Act requirements. This law addresses specific French concerns regard - ing data sovereignty and technological resilience. 3.2 Interaction of Data Regulation and Data Protection A core principle of the EU Data Act is that, when - ever personal data is involved, the GDPR continues to apply, and prevails in case of conflict. For mixed datasets (containing personal and non-personal data), the GDPR applies to the personal-data component. Where the two are technically or functionally insepa - rable, GDPR obligations cannot be bypassed and, in practice, the dataset must be handled under GDPR- compliant safeguards.
not preclude national law from allowing competitors of an undertaking infringing the GDPR to bring civil proceedings against the undertaking for unfair com - mercial practices, where such infringement confers a competitive advantage on that undertaking. 2.3 Collective Redress Mechanisms Representation Under the GDPR GDPR Article 80 allows individuals to mandate non- profit bodies, organisations or associations to lodge complaints and bring judicial proceedings on their behalf. Member states may also allow certain bodies to act without a mandate. “Action de Groupe” and the 2025 Reform France has allowed class-action style procedures ( action de groupe ) in specific sectors, including con - sumer matters and data protection. In 2025, France adopted a significant reform aimed at streamlining and expanding group actions (Law No 2025-391 of 30 April 2025). The new framework establishes a unified regime applicable across matters and is designed to facilitate claims for both cessation of unlawful conduct and compensation, subject to French procedural safe - guards and typically an opt-in mechanism for claim - ants. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation The EU Data Act The European Data Act (Regulation (EU) 2023/2854), adopted on 13 December 2023, entered into force on 11 January 2024 and has been applicable since 12 September 2025. It sets EU-wide rules on fair access to and use of data. It focuses on data generated by connected products and related services, and on switching and interoperability for data processing ser - vices (including cloud and edge computing services). The regulation applies to situations involving both per - sonal and non-personal data. Where personal data is concerned, the GDPR prevails in cases of conflict, and the Data Act operates without prejudice to EU data-protection law.
122 CHAMBERS.COM
Powered by FlippingBook