On May 25, 2018 came into force the General Data Protection Regulation (GDPR), which consolidates the rights of citizens and strengthens companies' obligations with regard to personal data. In France, the National Commission for Informatics and Liberties (CNIL) is responsible for implementing this ambitious text. Marie-Laure Denis, its president since February, has granted the World his first interview, on the occasion of the presentation of the annual report of the institution, Monday, April 15.
The number of complaints registered by the CNIL increased with the RGPD. The trend is confirmed in 2019?
The CNIL has registered more than 11,000 complaints in 2018. Of the seven months of 2018 when the RGPD was in force [il est entré en application le 25 mai 2018]we have seen an increase of 32% and this trend continues in 2019.
What are the points of the RGPD that still pose difficulties today?
Companies are wondering how complaints are handled in collaboration between the European CNILs. We also have a lot of questions about corporate obligations, such as the data registry, the data they can process, or the data breach notifications. Since the RGPD, companies must notify data breaches to the CNIL within 72 hours. There were 1,100 in 2018. We want to support all the actors. The 4 million French companies do not have the capacity to face their obligations in the same way. We try to adopt soft law mechanisms to help them. We will publish a guide for local authorities, as we published the TPE-PME guide in 2018.
The CNIL has recently imposed a heavy financial penalty on Google. Should we expect others? Is the 4% RGPD turnover sanction taboo?
There is no taboo to be used with discernment all the range of sanctions available to the CNIL, warnings to financial penalties, through the formal notices. We still have a strong desire for support but, from now on, it is the end of some form of tolerance, one year after the entry into force of the RGPD. The accompaniment would not be credible without control accompanied, if necessary, by sanctions.