Privacy & Information Security Law Blog

On February 24, 2010, the French Senate’s Committee of Laws published an amended bill on the right to privacy in the digital age (“Proposition de loi visant à garantir le droit à la vie privée à l’heure du numérique”) (the “Bill”).  Following the initial draft presented by Senators Yves Détraigne and Anne-Marie Escoffier, this revised version is based on a second Senate Report in which concrete proposals are made to amend the Data Protection Act.

Among the many amendments, organizations with more than 50 employees accessing or processing personal data would be required to appoint a data protection officer (“DPO”).  This obligation also applies to organizations whose data processing activities, such as the processing of sensitive data, biometric or genetic data or judicial data, require prior authorization from the French data protection authority (the “CNIL”).  The Bill also makes the DPO the central figure in the data compliance process, thereby strengthening the DPO’s role within an organization.  Acting in an independent manner, a DPO must inform and advise any person working on behalf of the data controller on issues relating to data protection, as well as maintain and regularly update a list of all the data processing activities carried out by the data controller.

The DPO also would play a central role in the handling of data security breaches.  In the event of a data security breach, the data controller must inform the DPO without delay or, in the absence of a DPO, the CNIL must be informed.  Upon learning of a breach, the DPO must immediately take all the necessary measures to (i) restore the integrity and confidentiality of the data, and (ii) notify the CNIL of the incident.  The DPO also must maintain an inventory of all data security breaches suffered by the organization.

The Committee’s Bill will be put to a vote before the general assembly of senators on March 23, 2010.  Olivier Proust, an attorney in Hunton & Williams’ Brussels office and a member of the Paris Bar, was among the legal experts who were consulted by the Senate in the course of drafting the amended Bill.

The Bill and the second Report are available (in French) on French Senate’s website.