4. GDPR in France: A Lot of Communication for a Jurisdiction Well Experienced in the Protection of Personal Data

France has been a pioneer country in terms of the protection of personal data, as demonstrated by the Informatique et Libertés law of 1978 and the creation of the national authority known as the CNIL. However, the first harmonization with the European framework of the Directive 95/46/CE occurred late, in 2004. By transposing (incorporating) the EU’s GDPR into French law, via an emergency procedure a few days before its coming into force in the European Union as a whole, France managed to modernize the protection of data with the rise of awareness among companies and public authorities. The CNIL, which received more competences and a better defined territorial application, maintains its role of controlling the regime of the most sensitive data (justice and police) while reminding individuals of the possible use of their rights on their data. Updating the Informatique et Libertés law of 1978 into the GDPR framework without changing its structure creates the problem of readability and confusion which increases the work of communication and requires the CNIL to repeatedly remind simply the new framework in cases. Considering that the grace period for companies to respect the GDPR is over, the CNIL will start its second year of applying the GDPR by moving from primarily informing and warning to sanctions (often for conserving the personal data of users without their consent) and increasing its cooperation with the other national authorities responsible for protecting personal data in the European Union.