The French government over the past few months has debated a draft bill for a “Digital Republic” that would modify a number of existing laws, including the French Data Protection Act. This bill would create a number of new obligations and General Data Protection Regulation-like requirements before the GDPR comes into effect on 25 May 2018.
The French National Assembly adopted the bill in its first reading on 26 January and passed it to the Senate, which made a number of amendments on 3 May. Among the Senate’s amendments is a new provision requiring the storage of personal data in data centers located in the European Union, and prohibiting the transfer of personal data to a non-EU third country. The Senate’s rationale for this provision is to ensure the applicability of EU privacy standards to French data, particularly in light of the European Court of Justice ruling on Safe Harbor.
The data-localization clause applies notwithstanding the “international undertakings” signed by France and the EU, but it is unclear whether the Senate, by using such a broad term, intends to refer to the GDPR and existing adequacy decisions. If not, it would greatly restrict transfers of personal data subject to French law out of the EU to cases where France or the EU signed international undertakings (e.g., the Passenger Name Record Agreements or the EU-US Terrorist Finance Tracking Programme Agreement).
The Senate’s provision as it stands does not align with the GDPR. Article 23 of the GDPR allows countries to restrict the scope of some rights and obligations at the local level, but transfers to third countries are not among such allowed restrictions.
Being subject to an accelerated procedure, the draft bill will be examined by a Joint Mediation Committee in the coming months. The proposal is unlikely to survive in its current form, given the provision’s incompatibilities with the GDPR. Representatives of the National Assembly and the Senate will have to draw up a compromise on the clauses on which agreement has not been reached.
photo credit: Solidarité via photopin (license)