FRANCE—CNIL inspections program to cooperate with foreign authorities

The French Data Protection Authority (CNIL) has finalized plans for its onsite inspection program for the period between April 2011 and April 2012. This year, the program will include cooperation with the U.S. Federal Trade Commission and other foreign authorities.

In particular, the CNIL will verify the legitimacy of the purposes, whether the requirements for individuals' information notice were complied with and retention period for images

Regarding the latter, CNIL will verify whether they dispose of the mandatory certification empowering them to host health data, which is issued jointly by the CNIL and the health ministry in compliance with Article L 1111-8 of the Public Health Code.

CNIL will verify the lawfulness of French companies’ data transfers outside the European Union, and it will also control foreign companies that receive data transferred from France. These inspections will be carried out in cooperation with foreign authorities such as the U.S. Federal Trade Commission and other data protection authorities in Europe.

The inspections have already begun, and they will take place throughout 2011 and into 2012. Half of the CNIL onsite inspections will take place in the context of this program. Other onsite inspections will arise, as they do each year, from a combination of investigations into complaints received by CNIL (between 4,000 and 5,000 complaints per year); topical subjects which cannot by definition be planned in advance, and from the CNIL's desire to verify whether undertakings given to it by both private and public bodies—in particular following the issuing of a formal notice—have indeed been respected.