FRANCE—Changes to the French data protection act

More quickly than expected, and as

in the March issue of the

, the French Data Protection Act has been amended by not one but two laws of March 29, 2011.

These laws change the functioning of the CNIL—especially its investigation and sanction procedures—in order to ensure due process. There will be a clear separation between decisions relating to investigations and decisions on sanctions. The president of the CNIL can no longer participate in both. Also, the CNIL agents in charge of onsite investigations must remind the person in charge of the premises to be investigated of her right to object to an onsite investigation, in which case, the investigation will have to be authorized by a judge.

The CNIL’s enforcement powers have been strengthened with additional weapons. It can order the publication of its sanction decisions—even in the absence of bad faith of the offender—which used to be a condition in the previous text. It is also worth noting that it can use the publication weapon at an earlier stage of the proceedings. The president and the executive committee (bureau) may indeed decide to publish a compliance order (

), for instance, which the CNIL would issue after an onsite investigation if it found non-compliance. It would then put public pressure on the data controller to cure the breach. As counter to that, the CNIL would have to publicize its decision to close the case if the data controller finally complied with its compliance order.

In terms of organizational changes, the president of the CNIL will become a full-time position as of September 1, 2012. A new body called

(defender of rights), whose mission is to defend the rights and liberties of people, will be able to lodge complaints with the CNIL and participate in the work of the CNIL. It is unclear yet how the CNIL and this new body will interact.