French Data Protection Authority (CNIL) Gains New Powers
On May 21, 2024, France enacted law No. 2024-449, enhancing the powers of the French Data Protection Authority (CNIL) in regulating the digital space. This law grants the CNIL new enforcement capabilities, including the authority to seize documents and record witness statements during inspections. Previously, the CNIL could only make copies of documents, but now it can conduct on-site inspections more effectively. However, the expansion of these powers raises concerns regarding the procedural safeguards available to companies and individuals during CNIL investigations.
The CNIL is now responsible for enforcing specific provisions of the Digital Services Act (DSA) for online platforms with a primary establishment or legal representative in France. This includes ensuring compliance with transparency obligations for advertisements and prohibiting profiling-based advertising that uses special categories of personal data, such as political opinions and health data. Non-compliance can result in substantial administrative fines, reaching up to six percent of the platform’s worldwide turnover, with additional penalties for failures during investigations.
Additionally, the CNIL has been empowered to enforce certain provisions of the Digital Governance Act (DGA) related to data altruism. This concept involves the voluntary sharing of data for public interest objectives, such as healthcare and climate change. The CNIL will maintain a public national register of recognized data altruism organizations and address complaints related to transparency obligations.
These changes signify a notable expansion of the CNIL’s role as a key digital regulator in Europe, reflecting the growing complexity of data protection regulations in France and the EU. The legal landscape is evolving rapidly, and stakeholders should monitor the CNIL’s upcoming enforcement actions to understand how these new powers will be applied.
Source: New Enforcement Powers for the French Data Protection Authority (CNIL)
