On the 12 May the French data protection authority (“CNIL”) announced its annual inspection program for 2016, explaining the various controls it has planned to carry out and outlining its sectors of priority.
According to the CNIL, it plans to conduct more than 400 inspections, both offline and online. It should be noted that from the 500 inspections carried out in 2015, one third of them were carried out online, from the CNIL’s premises and without the data controller being previously informed of such inspections.
The inspections to be carried out by the CNIL over the next year have been divided as follows:
- 140 will aim to ensure that companies comply with the orders issued by the CNIL within its formal notices and sanctions or address specific hot topics;
- 80 will deal with data subjects’ complaints received by the CNIL (8,000 were received in 2015);
- 80 will focus on video surveillance measures; and
- 100 will focus on three specific areas that the CNIL has set as its “yearly” priorities.
The first of these priority areas will concern data brokers, who serve as intermediaries between data controllers collecting personal data and the actors processing data for their commercial purposes.
The CNIL intends to inspect what data these actors process, whether and how consent has been obtained from the data subject, the effective exercise of rights by the data subject and the implementation of appropriate security measures.
Moreover, the CNIL shall also specifically focus on personal data processing by the data brokers within the context of profiling.
The two other priority areas of CNIL will concern Passenger Name Record files for airline passenger surveillance and National Health Insurance data processed by public authorities.
Organisations should be mindful of the CNIL's key areas of investigation to ensure that they are compliant as these areas are also likely to be the key focus areas for any enforcement action.
The CNIL’s announcement can be found here (French).
Submitted by Thierry Dor, Partner and Dane Rimsevica, Associate at Gide Loyrette Nouel - Paris France in partnership with DAC Beachcroft LLP