FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
Sectoral and Contractual Localisation Drivers France enforces data localisation for specific strategic sectors. Health data Electronic health data must be hosted by a certified health data hosting ( hébergeurs de données de santé or HDS) provider. While the law allows hosting within the EEA, there is a strong policy push for hosting in France or on sovereign cloud infrastructures. SecNumCloud The “ Cloud de Confiance ” doctrine promotes the use of cloud services qualified by ANSSI (SecNumCloud) for public administrations and essential operators ( Opérateur d’Importance Vitale / Opérateur de Servic- es Essentiels – OIV/OSE). This qualification imposes strict immunity from extraterritorial laws (like the US CLOUD Act), effectively requiring data to be stored and processed within the EU by entities that are not subject to non-EU jurisdiction. 5.4 Blocking Statutes France has a long-standing blocking statute (Law No 68-678 of 26 July 1968, as amended). Subject to inter - national treaties or agreements, it restricts the com - munication of certain economic information to foreign public authorities and, more broadly, the gathering/ communication of such information for use as evi - dence in foreign judicial or administrative proceed - ings. Covered Information The statute applies to documents or information of an economic, commercial, industrial, financial, or techni - cal nature where disclosure is likely to harm France’s sovereignty, security, essential economic interests, or public order. Personal data is not singled out as a standalone cat - egory in the law, but datasets that include personal data (eg, customer files) can be treated as covered when they qualify as economic/commercial/technical information and meet the “harm” threshold.
Enforcement Mechanism (SISSE – Since 1 April 2022) Since 1 April 2022, a decree has designated the Stra - tegic Information and Economic Security Service (SISSE) as the “single point of contact” for notifica - tions. Organisations receiving (i) a request from a foreign public authority to communicate potentially covered information, or (ii) a request relating to the constitution of evidence for foreign proceedings, must notify SISSE without delay and may obtain an admin - istrative opinion on whether Articles 1 and/or 1 bis apply. Criminal Penalties Breaches of Articles 1 or 1 bis of the law are criminal offences punishable by up to six months’ imprison - ment and a EUR18,000 fine (for individuals). For legal entities, the maximum fine is multiplied by five (ie, EUR90,000). Exceptions/Lawful Disclosure Routes The statute allows disclosure where an applicable international treaty or agreement provides for it (eg, co-operation/assistance mechanisms). Article 1 bis also operates subject to applicable laws and regula - tions. There is no general carve-out simply because the recipient is in the EU or because information is “publicly available” (these factors may be relevant fac - tually case by case, but they are not stated as blanket exceptions in the statute). Interaction With Data Protection The blocking statute is distinct from the GDPR, but the two can converge in cross-border evidence collection or regulatory investigations that involve personal data. In such contexts, organisations in France need to rec - oncile multiple constraints: GDPR Chapter V transfer rules, the blocking statute (including SISSE notifica - tion/opinion process), professional secrecy (eg, legal privilege), trade secret protection, and sector-specific secrecy obligations (eg, banking secrecy). 5.5 Recent Developments EU-US Data Privacy Framework (DPF) In September 2025, the General Court of the EU ( Latombe case ) upheld the validity of the DPF, reject - ing a challenge by a French parliamentarian. This provides renewed stability for transfers to certified
127 CHAMBERS.COM
Powered by FlippingBook