By Ariane Mole

The French Data Protection Act (Loi Informatique, fichiers et libertés) was recently amended and went into force on March 31.

The amendments intend to bring the law into compliance with the European Convention for the Protection of Human Rights.

As was emphasised several times during the parliamentary debates, and in particular by the French Minister for Justice, “the requirement for compliance arose from case law of the European Court of Human Rights [Dubus SA v France ruling of 11 June 2009]” and the requirement to respect Article 6-1 of the European Convention on Human Rights, which provides that everyone is entitled to an impartial court.

In order to ensure a strict separation of powers, the amended act provides that the members of the CNIL sitting in judgement and holding power to impose penalties may in no case hold any prosecuting or investigative powers.

It should therefore be emphasized that, as all the sanctions imposed by the CNIL to date were based on irregular proceedings, as a consequence, the most recent penalties run the risk of being cancelled by the French administrative supreme court, the Conseil d'Etat.

The new provisions on separation of powers will also necessitate internal reorganization of the functioning of the CNIL—in particular, the separation of respective powers and roles of its president and vice-presidents.   

The Conseil d'Etat has already cancelled several penalties imposed by the CNIL for breaching another provision of the European Convention for the Protection of Human Rights—Article 8, which protects privacy and premises—because the CNIL had not informed the controller of the premises of his right to object to an onsite inspection  

Already, on three occasions since November 2009, the Conseil d'Etat ruled that CNIL's onsite controls were illegal because it had failed to inform the controller of the premises that he had a right to oppose. Consequently, such controls were considered as "disproportionate interferences with privacy" in the meaning of the interpretation of Article 8 of the European Convention for the Protection of Human Rights, and the CNIL's financial penalties were cancelled.

In this regard, other amendments were made to the Loi Informatique et libertés regarding supervision of CNIL's onsite inspections by courts:

• From now on, the new French Data Protection Act provides that, in case of an onsite inspection, the CNIL must inform the controller of the premises about his right to object, except in cases of emergency or taking into account the gravity of the facts at issue or the risk of destruction or dissimulation of documents. In such cases where, by exception, the controller of the premises will not be granted a right to object to the onsite control, the CNIL will need to obtain the prior authorization of a judge—by court order—otherwise it will not be allowed to enter the premises.
• In addition, the powers to impose penalties of the CNIL's members sitting in judgement were strengthened. They now have the power to order the publication of sanctions in the press—even in the absence of bad faith from organizations that fail to comply with law—in contrast to the previous situation.

A future decree from the French Prime Minister—which will need to be reviewed first by the Conseil d'Etat before it can be passed—shall specify the circumstances in which the CNIL may bring emergency proceedings, allowing, notably, to interrupt processing or block certain data.

From September 1, 2012, the function of the president of the CNIL will become incompatible with any professional activity or any elected, national office. The president of the CNIL is currently a senator, and a new election within the CNIL for the post of president will be organized in the first two weeks of September 2012 in order to take these new rules into account.

Except for amendments concerning the CNIL's presidency, all other amendments to the Loi Informatique et libertés came into force on March 31, 2011. 

Ariane Mole is a partner at Bird & Bird in Paris. She can be reached at ariane.mole@twobirds.com.