Which authorities protect personal data in France?

Preserving personal data is one of the major issues of our time. It is essential to know who to contact if your rights are violated. In France, several supervisory authorities are responsible for protecting personal data (surname, first name, postal address, Social Security number, etc.). Each has specific responsibilities and areas of intervention.

The French Data Protection Authority (CNIL)

What is the CNIL?

The CNIL was established by the French Data Protection Act of January 6, 1978. It ensures the protection of personal data contained in computer or paper files, whether public or private. It ensures that data processing does not harm :

• To human identity;
• To human rights ;
• Privacy ;
• Public freedoms, both individual and collective.

This independent administrative protection authority (AAI) is made up of 18 elected or appointed members.

What does the CNIL do to protect personal data?

CNIL has four main missions.

Informing, protecting rights

One of the CNIL's key missions is to respond to requests from individuals and companies. At the same time, it implements communication initiatives aimed at the general public: press, website, social networks. It receives complaints from citizens in connection with :

• Online reputation, with requests to remove content from the web;
• Commerce. For example, opposition to receiving commercial e-mails;
• Human resources (HR), on the subject of video surveillance and geolocation of employee vehicles;
• The bank and borrowing. The complaint may relate to an entry in one of the Banque de France files.

Support for compliance/advice

CNIL is helping both private and public players to comply with the General Data Protection Regulation (GDPR). It offers them a toolbox adapted to their size and needs. The independent authority also advises and regulates. For example, it gives its opinion on draft texts concerning the protection of personal data.

Anticipating, innovating

The Commission Nationale de l'Informatique et des Libertés (CNIL) is contributing to a debate on the ethical issues surrounding data with :

• Its digital innovation laboratory, known as LINC ;
• The Foresight Committee ;
• The CNIL-INRIA European Prize ;
• Privacy Research Day, a major academic conference on data protection.

Control, sanction

The CNIL has the right to monitor private and public organizations. If it finds any breaches, it can issue formal notices or even impose sanctions. In 2022, the authority carried out 345 inspections, 147 of which resulted in a formal notice. Sanction procedures include :

• The ordinary sanction procedure, with fines of up to 20 million euros;
• The simplified sanction procedure, reserved for less complex or less serious cases.

What is CNIL's role?

The CNIL regulates personal data in the digital world. It supports companies in their compliance efforts, while helping individuals to exercise their various rights. As a reminder, individuals whose data is collected have several rights:

• The right to access data, at any time, without limitation;
• The right to rectify stored data and to object to their use;
• The right to portability, consisting in recovering the data provided, then transferring them to a third party;
• The right to be forgotten, based on the deletion of one's data and its dereferencing;
• The right to notification if data security is breached;
• The right to compensation for damage, whether material or moral, caused by the violation of GDPR ;
• The right to make a claim or appeal through a group action.

Dataventure is GDPR compliant

The agency designs conquest operations in line with GDPR. It uses opt-in databases as part of its performance e-mailing and SMS marketing solutions. It offers to rent targeted files and enrich data by drawing on its network's 100 million qualified opt-in profiles.

Co-sponsoring, co-registration, clic-lead... Every month, more than 3 million addresses are collected for major advertisers. Dataventure is one of France's leaders in opt-in.

Good to know: All collection systems offered by Dataventure are billed net of deduplication. In other words, only opt-in profiles not yet present in your active database are delivered to you.