FRANCE Law and Practice Contributed by: Frédéric Sardain and Claire Allavena, Jeantet
Moreover, high-risk AI systems already subject to sector-specific regulation will continue to be regulated by competent national regulators, such as the “National Agency for the Safety of Medicines and Health Products” (ANSM) for medical devices. Data Protection and Privacy under the AI Act In addition, the CNIL considers that the AI Act can extend and take over from data protection and privacy laws on certain well-defined points, such as: • the AI Act replaces certain data protection and privacy laws rules for the use by law enforcement agencies of real-time remote biometric identification in publicly accessible spaces, which it makes very exceptionally possible under certain conditions (article 5); • it exceptionally allows the processing of sensitive data to detect and correct potential biases that could cause harm, if strictly nec - essary and subject to appropriate safeguards (article 10); • it allows the re-use of personal data, includ - ing sensitive data, within the “regulatory sandboxes” framework. These sandboxes are intended to facilitate the development of systems of significant public interest (such as improving the healthcare system) and are placed under the supervision of a dedicated authority which must first consult the CNIL and verify compliance with a certain number of requirements (article 59). The regulation of AI in France and its impact on data protection reflect a comprehensive approach aimed at safeguarding individual rights while fostering innovation. The interplay between data protection and privacy laws and the AI Act demonstrates a cohesive framework that addresses the complexities of AI technol -
ogy. Together, these laws ensure that the devel - opment and deployment of AI systems are con - ducted ethically, transparently, and in alignment with data protection principles, promoting trust in AI technologies across society.
2. Privacy Litigation 2.1 General Overview
Recent Trends in Privacy Litigation in France There has been a rise in privacy-related lawsuits in France, largely driven by heightened aware - ness of data protection rights following the implementation of data protection and privacy laws. Many cases relate to data breaches, unau - thorised processing of personal information, or mishandling of a request to exercise rights (particularly the right to access). Individuals are increasingly seeking compensation for damages resulting from breaches, specifically emphasis - ing organisations’ accountability to protect per - sonal data. There has been a notable trend in seeking dam - ages for moral damage caused by data privacy violations. Plaintiffs are leveraging the data pro - tection and privacy laws’ provisions on damages to pursue financial compensation, reflecting a shift in how privacy violations are perceived and litigated. The CNIL plays a crucial role in shaping pri - vacy litigation. It not only enforces compliance through fines and investigations but also pro - vides guidance that can influence suits brought before courts. Injunctions and sanctions issued by CNIL can lay the groundwork for subsequent legal actions.
128 CHAMBERS.COM
Powered by FlippingBook