Privacy & Information Security Law Blog

The French Data Protection Authority (the “CNIL”) recently published its Annual Activity Report for 2018 (the “Report”) and released its annual inspection program for 2019.

The Report provides an overview of the CNIL’s enforcement activities in 2018. In particular, the Report revealed that:

• The CNIL received a record number of complaints in 2018 (11,077 complaints, which represents an increase of 32.5 percent compared to the number of complaints in 2017). This upward trend was confirmed in the first few months of 2019, and may be due to the media impact of the EU General Data Protection Regulation (“GDPR”) and increased public awareness. According to a survey conducted in April for the CNIL, 62 percent of French people have heard about the GDPR and 70 percent say that they are more aware of the protection of their personal data compared to past years. Of the 11,077 complaints received by the CNIL in 2018, approximately 20 percent are the subject of cooperation between EU data protection authorities. The complaints mainly concern the following issues or sectors:
  • dissemination of personal data on the Internet: the CNIL received 373 requests to delist information from search results (“right to be forgotten” requests) (35.7 percent of complaints);
  • marketing issues, and in particular, direct marketing by email and text message (21 percent of complaints);
  • human resources issues (e.g., excessive CCTV surveillance, geolocation and refusal to disclose the employee’s professional file) (16.5 percent of complaints);
  • the banking/credit sector (8.9 percent of complaints); and
  • the health and social sector (4.2 percent of complaints).
• The CNIL received 1,170 data breach notifications in 2018. The vast majority of them were due to confidentiality breaches.
• The CNIL stated that it will give priority to supporting data controllers when they file a data breach notification within 72 hours of becoming aware of the breach. The purpose of this approach is to help data controllers take relevant measures to mitigate the consequences of the breach. However, the CNIL stressed that a breach affecting a large amount of personal data or sensitive data may lead to enforcement actions if necessary, even if the data controller has provided notice of the breach within the 72-hour time frame imposed by the GDPR. Further, the CNIL will adopt a repressive approach when the breach is not notified within 72 hours. Additionally, if conducting an inspection, the CNIL will systematically verify that data controllers have implemented data breach procedures and maintain records of breaches.
• 51,000 organizations have appointed a data protection officer (“DPO”), bringing the DPO total to 17,000 (as a single DPO may be appointed for several organizations).
• The CNIL carried out 310 inspections in 2018, including 204 on-site inspections (when the CNIL visits a company’s facilities and accesses anything that stores personal data); 51 online inspections; 51 document reviews (when the CNIL requires an entity to send documents or files upon written request); and four hearings (when the CNIL summons representatives of organizations to appear for questioning and provide other necessary information). The CNIL served 49 formal notices to companies in 2018, including to insurance companies (five formal notices) and marketing companies collecting personal data from mobile phones via software development kit (“SDK”) tools for the purposes of sending targeted ads (four formal notices). Formal notices are not sanctions. If the company complies with the formal notice within the time limit imposed by the CNIL in its notice, the CNIL will close the case. Overall, only 11 sanctions were imposed by the CNIL’s Restricted Committee in 2018, including 10 fines. The majority of those fines (seven fines) were imposed on companies following a personal data breach. The CNIL explained that it did not punish the companies for the incident itself, but for lack of adequate security measures, which made the incident possible. The small number of fines in 2018 may be explained by the two following factors:
  • In the vast majority of cases, the simple fact that the CNIL intervenes results in the implementation of the necessary compliance measures. The CNIL underscored this by noting that at each stage of the investigation of a complaint and/or an inspection, organizations have the option to follow the CNIL’s recommended measures.
  • 2018 was a transitional year, and intended to allow businesses to understand and implement what the GDPR requires. The CNIL explained that 2019 marks the end of this transitional period between the previous data protection regime and the GDPR. The CNIL made it clear that it will now fully examine whether the new obligations and rights under the GDPR (DPIA, data portability, keeping a register of data processing activities and of data breaches) are applied. The CNIL announced that, in order to respond appropriately, it will take into account the gravity of the infringement, the business activity and size of the organization concerned, the degree of cooperation of the organization with the CNIL and its good faith.
• The CNIL announced that about a quarter of the inspections for 2019 will focus on the following topics as part of its annual inspection program:
  • respect for data subjects’ rights: the CNIL will verify that data subjects receive a clear and complete answer within the time limits prescribed by the GDPR when they exercise their rights under the GDPR (such as the new data portability right) and under the French Data Protection Act (such as the right for data subjects to define the ways their personal data will be processed after their death);
  • the processing of minors’ personal data (e.g., on social networks or at schools); and
  • the allocation of responsibilities between data controllers and data processors.

Finally, the Report outlines some of the topics that the CNIL will further consider in 2019, including voice assistants and cloud computing services. This will allow the CNIL to update its 2012 recommendations for companies using such services.