France - CNIL and Ethnic Statistics - Creating files which reveal, directly or indirectly, religious affiliation, or the racial or ethnic origin of individuals is strictly prohibited by law. Article 8-1 of the French Data Protection Act prohibits the processing of sensitive data, particularly data revealing, directly or indirectly, religious affiliation, or racial or ethnic origins of individuals. Failure to comply with article 8-1 is a criminal offense punishable by 5 years' imprisonment and/or a fine of up to EUR 300,000 (EUR 1,500,000 for companies). Further, the CNIL may impose different sanctions, including a warning which can be public, an administrative fine with a maximum amount of EUR 150,000 (up to EUR 300,000 for repeat offenses) and the possible publication of the decision itself in the press. The exceptions to Art 8-1 are limited and strictly framed by law: · when strictly necessary, to record sensitive data with prior written consent of the data subject or when the latter has already publicly disclosed them; · religious associations or organizations may carry data relating to their members and the individuals with which they maintain regular contact; · researchers and statisticians may conduct studies on diversity by relying on sensitive data, provided that they comply with the framework set out by the law and the Conseil constitutionnel (the French Constitutional Council) in its decision n° 2007-557 dated 15 November 2007 which states that "processing necessary to the conduct of studies on measurement of the diversity of individuals' origins, discrimination and integration […] shall not, without infringing art. 1 of the French Constitution [which states that the Republic "ensures equality before law, without distinction of origin, race or religion"], rely on ethnic origin or race". Only "objective" data may be processed, under conditions specified by the CNIL, ensuring data protection and anonymization. For more information, please contact Denise Lebeau-Marianna or Alexandra Coti.