In November 2009, the Conseil d'Etat (French supreme administrative court) ruled that the CNIL (French Data Protection Authority) has to inform public or private entities prior to on-site investigations and must grant them the right to object to such investigations unless prior authorisation has been obtained from the court. This may appear surprising given that, under the French Data Protection Act, there is no legal obligation for the CNIL to provide such information.
According to the ruling, the CNIL may carry out investigations on business premises provided that the local public prosecutor has been informed beforehand.
However, if a company officer or representative objects, the CNIL must obtain a court order to proceed with the investigation, with the assistance of law enforcement forces if necessary. In such case, pursuant to Article 44 of the French Data Protection Act, on-site inspections must take place under the supervision of the authorising judge.
The Conseil d'Etat considered that companies are entitled to "privacy" of their business premises under the terms of Article 8 of the European Convention on Human Rights (under which any interference by a public authority with the exercise of this right shall only be justified by the law or for the protection of the rights and freedoms of others).
Unless the entity being investigated is informed of its right to object prior to the investigation, or is summoned by court order, the court ruled that the CNIL's interference with the privacy of business premises would be disproportionate.
The supreme administrative court also considered that the entity's right to object (and subsequent court authorisation) provides a sufficient guarantee but only as long as proper information about the right to object has been provided. A mere reference to Article 44 of the French Data Protection Act is not sufficient.
The CNIL has officially requested an amendment to the applicable legislation in order to obtain ex parte court orders before each investigation so as to preserve the efficiency of on-site investigations without notice.
In the meantime, all on-site investigations performed before this ruling was made are considered to have been illegal. Therefore, no sanction can be taken on the basis of these investigations. Until the law is amended in order to allow the CNIL to obtain ex parte court orders, the CNIL has to inform entities of any planned inspections. If an objection is raised to the CNIL's investigators entering the premises, investigators will have to leave, ask for a court order and only return once it has been obtained.