Appointed at the beginning of this year, Marie-Laure Denis brings a wealth of experience to her new role as head of France's data protection authority, the CNIL.

Denis was deputy director of the Office of the Mayor of Paris from 1996 to 1998. Then, following several years in senior positions in various government ministries, she became a member of the Higher Audiovisual Council in 2004. From 2011 to 2016, she was also a member of the Regulatory Authority for Electronic Communications and Post Office. Since 2017, Denis has been a member of the Dispute Resolution and Sanctions Committee of the French Energy Regulatory Commission.

Denis talked to The Privacy Advisor about her priorities as head of the CNIL and what to expect from the regulator in the near future.

The Privacy Advisor: The CNIL has taken the lead in Europe in fining Google 50 million euros under the EU General Data Protection Regulation. How strategic was this decision?

Marie-Laure Denis: On May 25 and 28, 2018, the CNIL received group complaints from the associations of None Of Your Business and La Quadrature du Net. LQDN was mandated by 10,000 people to refer the matter to the CNIL. It was therefore essential for the CNIL to take action.

Marie-Laure Denis

Initial exchanges with our counterparts, including the Irish authority, have shown that the one-stop-shop system does not have to apply. We, therefore, initiated investigations, which have revealed breaches.

The amount of the sanction and the violations concerned (validity of consent and quality of the information provided to users) are certainly emblematic, but the CNIL's primary approach was to respond to the requests of complainants and the concerns expressed in public opinion.

The Privacy Advisor: You have also recently closed an investigation into Vectaury. What is the news on that? More broadly, are location-based services going to be in the spotlight for breaches in the coming months?

Denis: The processing performed by companies like Vectaury is based on a massive collection of data, including location data. As such, they are closely monitored by the CNIL. We are also interested in the roles and level of responsibility of other actors, such as application publishers and advertisers.

In general, the subject of the use of location data is particularly closely monitored by the CNIL, whether in the context of the consumption of [an Uber-like] service, employee monitoring or meeting applications.

This is because location data is particularly intrusive in that tracking your movements can be very revealing of your private life — your place of residence, your place of work, your consumption habits, the possible attendance of places of worship, the location of your relatives.

The Privacy Advisor: How has the CNIL found working alongside the European Data Protection Board? What sort of changes have you seen to cross-border cases since the GDPR?

Denis: The general work of interpreting the texts continues. New and much more operational and practical issues related to cooperation, often related to national procedural practices, are emerging. Many exchanges take place in the context of the investigation of complaints. Both in the analysis of possible breaches and the follow-up to be given.

Exchanges are also taking place on ongoing investigations concerning major players; these procedures are part of a dynamic of cooperation over longer periods.

In general, the last 10 months have been a time to move from theory to practice.

The Privacy Advisor: How does the CNIL categorize the complaints it receives? Are they predominantly inquiries or requests for information? What percentage leads to full investigations?

Denis: The media impact of the GDPR led to a record number of complaints and an increased awareness among citizens.

In 2018, CNIL received a record of 11,077 complaints (up 32.5% compared to 2017). About 20% of these complaints are tackled in the framework of  European cooperation with other supervisory authorities. The effective exercise of rights represents the majority of the complaints received.

These complaints relate mainly (35.7%) to the dissemination of data on the internet. We received 373 requests for delisting, a right now consecrated by the GDPR. People massively request their data to be deleted from the internet (names, contact details, comments, photographs, videos, accounts, etcetera). These kinds of complaints show how difficult it can be for individuals to manage the digital life and, in particular, their online reputation. We also received 21% of complaints relating to marketing/business and 16.5% related to human resources.

The main objective of CNIL is compliance. This means that not all complaints lead to a sanction because there are several ways to comply during the examination process.

The Privacy Advisor: Do you envisage many own-initiative investigations? In what sectors? Why are these particularly important?

Denis: In 2019, CNIL’s investigations program will focus on complaints and two main themes directly inspired by the GDPR.

First, an investigation strategy based on the complaints CNIL receives (either collective or individual) in order to stay in touch with the expectations of citizens. These investigations will include the practical exercise of rights, which represents about 73.8% of the complaints received.

Secondly, investigations on main and cross-sector themes, rather than specific processing: the sharing of responsibilities between processors and subcontractors, the data of children (photos, biometric data and CCTV in schools, parental consent for children under 15).

Almost one year after the implementation of the GDPR, the transition or tolerance period is now over. The CNIL intends to fully verify compliance with the GDPR (register of processing, data protection officer, data protection impact assessment, data breach notification, data portability, etcetera). In the case of breaches, it will use its enforcement power always with discernment.

The Privacy Advisor: Does the role played by the CNIL in France differ in any significant way from DPAs in other jurisdictions? Why/how?

Denis: The GDPR and the law enforcement directive aim to harmonize as much as possible the missions, powers and competences of DPAs in the EU. It is important in order to collaborate effectively and to ensure uniform protection to the data subjects.

We are lucky to be a rather old DPA; we celebrated CNIL’s 40th birthday last year. So we have a strong experience in several key missions such as enforcement, pedagogy for professionals, DPO training, citizen awareness, IT expertise and foresight, ethics, international and European affairs, etcetera. The CNIL has also a broad and complete competence on both private and public sectors including in the field of police and intelligence.

The Privacy Advisor: There has been a lot of speculation about third-country adequacy for the U.K. post-Brexit. Is this likely? Are there lessons to be learned from the EU-U.S. Privacy Shield arrangement?

Denis: First of all, let’s recall that it is the European Commission that is competent to decide and issue an adequacy decision on the U.K. The U.K. has implemented the GDPR and transposed the Law Enforcement Directive, so it should facilitate the work to assess the level of adequacy of the U.K. if the texts of law are not modified meanwhile. It is important to note that adequacy also covers access by public authorities for national security including by the intelligence community. This will be part of the assessment. With respect to the Privacy Shield, we should be careful and not confuse both exercises as the U.S. adequacy system is different based on self-certification of companies but the referential to be used for assessing any adequacies remain for the EDPB the same (e.g., WP254 adequacy referential).

The Privacy Advisor: Finally, what are the biggest items on the agenda for the CNIL for the next 12 months?

Denis: This year, the CNIL will focus on three main priorities: mastering GDPR, a keystone of a trusted digital environment; positioning the CNIL as an expert on infrastructures and digital platforms; and diplomacy of personal data at European and international level.

This year will be decisive in giving credibility to the new legal framework and turning this ambitious European gamble [the GDPR] into operational success. The expectations of civil society and economic actors are very strong and this model generates interest around the world. The CNIL will articulate its action around two main lines of action: pedagogy and deterrence.

In order to continue to be an effective and pragmatic digital regulator, the CNIL must also constantly reinvent itself to be able to always master subjects that require advanced technological expertise. In this context of permanent innovation, the CNIL always makes sure to anticipate what’s ahead.

Finally, the CNIL intends to maintain a leading role at the European level by defending French positions in the EDPB, particularly in the framework of the 2019–20 work program. It will participate in initiatives aimed at developing operational cooperation with its non-European counterparts and a convergence of data protection principles worldwide.

In addition to these short-term priorities, a strategic roadmap for years 2019–21 will be available before summer.

Photo by Samuel Zeller on Unsplash