protect personal data, accompany innovation, …€¦ · protection for their personal data. data...
TRANSCRIPT
The CNIL in a Nutshell
PROTECT PERSONALDATA, ACCOMPANY
INNOVATION, PRESERVECIVIL LIBERTIES
Created in 1978, the CNIL is an independent administrative authority that
exercises its functions with accordance to the French Data Protection Act
of the 6th of January 1978, amended the 6th of August 2004.
The CNIL’s independence is guaranteed by its composition and its organi-
sation. The seventeen members that form the commission are for the most
part elected by the assemblies and jurisdictions to which they belong.
The CNIL elects its chair amongst its members and does not receive any
instructions by any other authority to the election of the chair.
4 Parliamentarians (2 Assembly members,2 Senators).2 members of the French Economic, Socialand Environmental Council.6 representatives of high jurisdictions (2 StateCouncil members, 2 members of the Court ofCassation and 2 members of the Audit Court).5 qualified public figures appointed by:the President of the National Assembly (1 publicfigure), the President of the Senate (1 publicfigure), the French Cabinet (3 public figures).The mandate of the commissioners is for 5 years,or, for parliamentarians, as long as the durationof their mandate.
AN INDEPENDENT ADMINISTRATIVE AUTHORITY
Plenary SessionThe members of the CNIL congregate in plenary sessions once a week on an agenda pre-established by the Chair. A major part of these sessions is devoted to the assessment of bills and draft decrees that are submitted by the government for an official CNIL opinion. Additionally, the CNIL gives authorisations for the processing of sensitive data including, but not limited to, those requesting the use of biometrics. It also analyses the consequences of new technologies on citizens’ private life.
Restricted CommitteeSince the law of the 6th of August 2004, the CNIL’s restricted committee, which is composed of 5 members and a Chair other than the CNIL’s Chair, can render diverse sanctions on data controllers who do not respect the law. The amount of the penal sanctions can reach up to €300,000. These penal sanctions can also be made public.
INSTITUTIONAL PROCEEDINGS
2,277ADOPTEDDECISIONS ANDDELIBERATIONS
100OPINIONS
390AUTHORISATIONS
ADVICE AND REGULATION
401BIOMETRIC SYSTEMAUTHORISATIONS
6,123GEOLOCALISATIONDEVICEDECLARATIONS
14,441ORGANISATIONS WITH ADATA PROTECTION OFFICER
COMPLIANCE MONITORING
92,663PROCESSED FILES
11,892DECLARATIONSPROCESSED REGARDINGVIDEO SURVEILLANCESYSTEMS
44CNIL PRIVACY SEALSDELIVERED
STATUS & COMPOSITION
THE CNIL’S FACTS AND
THE CNIL’S MISSIONS
68%OF INDIVIDUALS KNOW ABOUT THE CNIL
36,000 FOLLOWERS ON TWITTER
INFORMING & EDUCATING
The CNIL has the general mission of informing
individuals of their rights accorded to them
by the French Data Protection Act. The CNIL
responds to requests made by individuals
and companies alike. In 2014, it received
almost 133,000 telephone requests for
advice or further information. The CNIL leads
awareness campaigns targeting the general
public by means of the press, its website,
social networks and target workshops.
While being directly requested for leading
training programmes on the Data Protection
Act within many organisations, companies,
or institutions, the CNIL participates also
in conferences, seminars, and workshops in
order to inform and be informed. It brings
together a collective of over 60 organisations
that lead campaigns in favour of education on
the digital world.
1
PROTECTING THE RIGHTS OF CITIZENS
Any individual can contact the CNIL, when
they are experiencing difficulties in exercising
their data protection rights. The CNIL ensures
that citizens can effectively access their data
contained in any processing. In 2014, the CNIL
received 5,825 complaints which included:
e-reputation (requests for the erasure of data
on the internet); commerce (requests to stop
publicity by mail); human resources (super-
vision mechanisms like video surveillance or
the geolocalisation of vehicles); and banks and
loans (objection to their registration within the
files of the Banque de France).
2
FOCUS
Filling out Complaints OnlineThe CNIL offers on its website an online complaint service for handling
of complaints in the sectors of banking and credit, work, business
and internet.
Mobile version of cnil.fr
IT’S YOUR RIGHT!The Right to Access,to Object and to RectifyEveryone has the right to be informed of all
data stored in a file by contacting directly
those who have created and store the file.
Moreover, they have the right to obtain a copy
of the datawith the costs of doing so remaining
equal to that of the reproduction of the data.
Any individual has also the possibility to object
to the processing of their personal data on
legitimate grounds. They can refuse the filing
of their data without having to justify themselves,
if the information requested will be used for
commercial purposes.
Everyone can rectify, complete, update, block
or erase information about them, when this
information is declared to be erroneous or
inexact; moreover, this also extends to cases
of prohibitions on the collect, utilisation, com-
munication or conservation of said data.
5,825COMPLAINTS RECEIVED
The Right to Access National Security,Defence and Public Security FilesOn the behalf of citizens, the CNIL can access
national security, defence, and public security
files that contain their data-especially sur-
veillance and judicial police files. This type
of access is called an indirect access. When
requesting the CNIL to consult these files,
one must write a letter to the CNIL indicating
precisely their address and their telephone
number as well as including a photocopy of
their identity card.
The regulation of data protection is brought
about by differing tools:
authorisations that implement data proces-
sing;
official opinions on the government’s draft
legislation that will impact data protection or
create new files;
REGULATING & ADVISING
legal frameworks simplifying the completion
of prior formalities;
recommendations allowing the CNIL to esta-
blish its doctrine in different domains;
requests for advice from data controllers,
which are being sent in higher quantities and
notably by data protection officers.
3
ACCOMPANYING THE COMPLIANCE
4The objective is to propose a compliance “ tool-
box” by using the different means of action at
the CNIL’s disposal: the data protection officers
(Correspondants Informatique et Libertés)
who form a privileged network of experts; the
development of privacy seals and Binding
Corporate Rules that frame transfers of personal
data within multinational companies outside
the EU; the creation of “ compliance packages ”
that are sector-based reference models covering
an entire sector or professional branch.
The Privacy SealsThe CNIL now has the power to deliver privacy
seals for products, procedures or governance
process that deal with data protection.
The “ CNIL privacy seal ” allows a company to
distinguish itself from others by the quality of
their services. For the users, it is a trust indi-
cator on products, procedures and governance
process that allows users to identify and favour
organisations that guarantee a high level of
protection for their personal data.
Data Protection Officers(CILs)At an era where the digital world is inherent
to our daily lives, the data protection
officers (CILs) have become absolutely
essential actors within public and private
organisations which deal with personal
data.
Ensuring an optimal level of protection
for personal data is not only a legal
obligation, but also a question of the
company’s credibility regarding the users
or the clients. In 2014, almost 14,500
organisations chose to appoint a data
protection officer in order to reinforce
the technical and legal security of their
informational heritage.
Correspondant In
form
ati
qu
e et Libertés
Le L@bo CNIL
CookievizMORE THAN 100,000
DOWNLOADS ON CNIL’S WEBSITE
Mobilitics
ANTICIPATING INNOVATION
In the framework of the CNIL’s innovation and
prospective, it strives to consolidate two objec-
tives: the taking into consideration, at a very
early stage, of new subjects like tendencies,
technologies or upcoming uses for data; and,
the assessment of case studies and analyses
brought about by innovative tools and projects.
The LaboratoryThe CNIL constructed a laboratory within its walls
that is dedicated to the testing and experimenta-
tion of cutting-edge products and applications.
This laboratory has provided for the possession of
products at their beta stages in order to test their
functions and evaluate their potential impact on
the private lives of citizens. With keeping “ privacy
by design” in mind, the CNIL strives to reinforce
its consulting role for companies in regards to
the integration of personal data requirements
within their technological developments. Finally,
the CNIL aims to contribute to the development
of technological solutions that protect citizens’
private life.
The Prospective CommitteeIn order to reinforce its mission to elaborate and
reflect on potential prospects, the CNIL created
in 2012 the Prospective Committee that brings
together six external experts. This committee
strives firstly to be the coordination committee
of scientific studies led by the CNIL. The two
main missions of the Prospective Committee
are the annual establishment of the studies led
by the CNIL and the exploration of new fields
of studies.
5
N°XXXX-XXXXEXPIRE : XX/XX/XXXX
THE CNIL WORLDWIDE
The European Union adopted in 1995 a directive aiming
at harmonising amongst the 15 Member States (now
28 Member States) the guaranteed protection to every
person wherever in Europe their data is being processed.
A reform package on the data protection regime was
presented in by the European Commission in January 2012.
WP29: since February 2014, the CNIL’s Chairwoman has
presided as Chair over the Article 29 Working Party—the
working party that assembles once every two months
representatives from the 28 European and independent
data protection authorities.
This body’s objective is:
to contribute to the establishment of European norms
by adopting recommendations;
to render opinions on the level of protection guaranteed
by countries outside the EU;
to advise the European Commission on all projects having
an impact on data protection rights and liberties.
The CNIL, as a representative at the International
Conference of Data Protection and Privacy Commissioners,
participates regularly in collaboration with other
international actors:
the OECD: the CNIL participates in the working group
on the revision of guidelines regarding privacy rights
and transfers of personal data as well as represents itself
at the international Conference of Data Protection and
Privacy Commissioners;
the Council of Europe: the CNIL follows the moder-
nisation of the Convention 108 and attends the activities of
the Consultative Committee of the Convention 108 (T-PD)
as an observer acting as representative of the International
Conference of Data Protection and Privacy Commissioners;
the APEC: the Asian-Pacific Economic Cooperation
zone brings together 21 countries; moreover, it aims at
facilitating the cross-border commerce as well as the
development of e-commerce within the zone. The CNIL
participates in the working group on privacy rights as
representative of the International Conference of Data
Protection and Privacy Commissioners as well as in the
Committee for the interoperability of the APEC Cross
Border Privacy Rules-EU Binding Corporate Rules as
member of the WP29.
FrancophoneFor about ten years, the CNIL has engaged itself in a data
protection promotional campaign within francophone
countries. These actions have given way to the creation
in 2007 of the Association Francophone des Autoritésde Protection des Données Personnelles (Association for
Francophone Data Protection Authorities), which partners
with the International Organisation of La Francophonie (OIF).
Its success has also brought about the adoption of privacy
rights legislation by countries within the francophone zone
including Burkina Faso, Mali, Madagascar, Morocco and Turkey.
FOCUS
INSPECTING AND SANCTIONINGThe ex-post inspections are considered to be the
favoured method of intervention by the CNIL for
the data controllers. It allows for the CNIL to
verify the concrete implementation of the law.
The programme of interventions is established
in function of the current events and the high
level issues (new technologies, problematic
current events and revelations) for which the
CNIL is called upon to inspect.
The CNIL has the competence to inspect video
surveillance systems established within the
French territory. It has performed 88 video
surveillance inspections in 2014 alone.
Regarding inspections or complaints, the CNIL’s
restricted committee (composed of 5 members
and a Chair other than the CNIL’s Chair) can render
various types of sanctions which include:
a warning, which can be made public.
Hypothetically, if the CNIL’s Chair has already
officially rendered an order and if the data
controller does not changed its practices to
conform to the order, the restricted commit-
tee can render more coercive sanctions after
respecting the contradictory principles within
administrative procedures;
a monetary sanction (except for Government
data processing) of up to €150,000 and up
to €300,000 for repetitive violations. This
sanction can be made public; moreover, the
restricted committee can demand the sanction
be published in the press at the costs of the
sanctioned organisation. The total amount for
the sanctions will be collected by the Public
Treasury and not by the CNIL;
a cease-and-desist injunction on the data
processing;
a withdrawal of the prior authorisation given
by the CNIL.
In cases of immediate and grave violations on
fundamental rights and freedoms, the CNIL’s
Chair can refer a request to the competent
jurisdiction to order any necessary security
measure. It can also denounce any violations
of the French Data Protection Act to the State
Prosecutor.
Online investigationsSince March 2014, the CNIL has a new
investigatory power that allows it to be
more reactive and efficient regarding digital
practices. From now on, investigations can be
carried out from CNIL’s offices without data
controller being present, who will be informed
once the verifications are performed.
6
NUMBERS IN 2014
The CNIL walks hand-in-hand with the rapiddevelopment of new technologies and participates
in the construction of a code of digital ethics.”
Beyond raising awareness and sharing infor-
mation on data protection culture, the CNIL
has an advisory power, an onsite and offsite
investigatory power as well as an administra-
tive sanctioning power. It has established and
coordinates the network of Data Protection
Officers (also known as the “ Correspondants Informatiques et Libertés”). The CNIL analyses
the consequences of new technologies on
citizens’ private life. Finally, it collaborates
closely with its European and international
counterparts.
“What is personal data? Personal data is any information
concerning a natural person that can
directly or indirectly, potentially identify
by referencing an identification number
(i.e., social security number) or one or
more elements that only concern a single
person (i.e., first and surname, date
of birth, biometric elements, digital
imprint, DNA, etc.).
ADDITIONALINFORMATION
421INVESTIGATIONS
58ONLINE INVESTIGATIONS
88INVESTIGATIONSREGARDING VIDEOSURVEILLANCE
PROTECTING CITIZENS
INVESTIGATING
5,825COMPLAINTS
5, 246REQUESTS FOR ACCESSTO PERSONAL DATAWITHIN: POLICE FILES,SURVEILLANCE FILES,FICOBA, ETC.
62ORDERS RENDERED
7WARNINGS
8FINANCIAL SANCTIONS
3ACQUITTALS
RENDERING ORDERS & SANCTIONS
Contact the CNILCommission nationale de l’informatique et des libertés8, rue Vivienne CS 30223 75083 Paris Cedex 02 France Tel: 01 53 73 22 22 Fax 01 53 73 22 00
www.cnil.fr
Follow the CNIL on...
20
14
06
26