was therefore tabled on 13 December 2017
6 and fast-tracked through Parliament.
After an appeal brought before the Conseil Constitutionnel indicative of the tension
between the two houses,
7 the bill was enacted and then published on 21 June 2018.
8
The Act of 20 June 2018 not only adapts French law to the GDPR, but it also
transposes Directive 2016/680 on the processing of personal data into criminal law.
The French legislature has not systematically implemented the provisions of the
GDPR, but has adopted the policy of cross-referencing, which hardly facilitates their
proper applicability.
9 This explains why the Ordinance of 12 December 2018 was
made to improve the legibility of the act and its consistency.
10 This lack of foresight,
which is not conducive to legal certainty, is to be regretted.
The wording of the LIL currently in force bears little resemblance to the initial
text but it is still tremendously symbolic.
11 Article 1 is unchanged: “Information
technology should be at the service of every citizen”. The adaptation of the French
law to the European package effects a “paradigm shift”
12 : ex-ante supervision with
prior declarations is replaced by ex-post supervision. The responsibility of actors
(accountability principle) and the protection of natural and legal persons are
reinforced.
13
These basic texts are supplemented by other legislation (e.g. article 9 of the Civil
Code on the protection of privacy, legislation on unfair clauses in the Consumer
Code), other regulations (e.g. the three decrees of 29 September 2017 on the
obligation for on-line platform operators to provide truthful information
14
) and soft
6 Assemblée Nationale, No 490, Draft law relative to the personal data protection: http://www.
assemblee-nationale.fr/dyn/15/dossiers/alt/donnees_personnelles_protection.
(Accessed
21 September 2018). See also: CNIL, Deliberation no 2017-299 of 30 November 2017,
CNILTEXT000036195647. Conseil d’État, Opinion of 7 December 2017, no 393836, NOR:
JUSC1732261L.
7 Conseil Constitutionnel, Decision no 2018-765 DC of 12 June 2018, JORF 20 June 2018: NOR:
CSCL1816349S.
8 Act no 2018-493 of 20 June 2018, JORF 21 June 2018; Dossier (2018).
9 See, for example, a critical article: Martial-Braz (2018), p. 459.
10 Act no 2018-493 of 20 June 2018, Art. 32. Ordinance no 2018-1125 of 12 December 2018, JORF
13 December 2018. See in particular CNIL, Deliberation no 2017-299 of 30 November 2017,
CNILTEXT000036195647. See also Fauvarque-Cosson and Maxwell (2018), p. 1034; MartialBraz (2018), p. 459.
11 Le Gouvernement a fait le choix symbolique de ne pas abroger la loi fondatrice du 6 janvier 1978,
Explanatory Note to Act no 2018-493, p. 7.
12 See, for example, Hébert (2018), p. 9.
13 Desgens-Pasanau (2018b), p. 25.
14 Decrees nos 2017-1434, 2017-1435 & 2017-1436 of September 29, 2017, JORF 05 October
2017: entry in force on 1 January 2018 except the Decree no 2017-1435 which came into force on
1 January 2019.
160
L. Nicolas-Vullierme
6 and fast-tracked through Parliament.
After an appeal brought before the Conseil Constitutionnel indicative of the tension
between the two houses,
7 the bill was enacted and then published on 21 June 2018.
8
The Act of 20 June 2018 not only adapts French law to the GDPR, but it also
transposes Directive 2016/680 on the processing of personal data into criminal law.
The French legislature has not systematically implemented the provisions of the
GDPR, but has adopted the policy of cross-referencing, which hardly facilitates their
proper applicability.
9 This explains why the Ordinance of 12 December 2018 was
made to improve the legibility of the act and its consistency.
10 This lack of foresight,
which is not conducive to legal certainty, is to be regretted.
The wording of the LIL currently in force bears little resemblance to the initial
text but it is still tremendously symbolic.
11 Article 1 is unchanged: “Information
technology should be at the service of every citizen”. The adaptation of the French
law to the European package effects a “paradigm shift”
12 : ex-ante supervision with
prior declarations is replaced by ex-post supervision. The responsibility of actors
(accountability principle) and the protection of natural and legal persons are
reinforced.
13
These basic texts are supplemented by other legislation (e.g. article 9 of the Civil
Code on the protection of privacy, legislation on unfair clauses in the Consumer
Code), other regulations (e.g. the three decrees of 29 September 2017 on the
obligation for on-line platform operators to provide truthful information
14
) and soft
6 Assemblée Nationale, No 490, Draft law relative to the personal data protection: http://www.
assemblee-nationale.fr/dyn/15/dossiers/alt/donnees_personnelles_protection.
(Accessed
21 September 2018). See also: CNIL, Deliberation no 2017-299 of 30 November 2017,
CNILTEXT000036195647. Conseil d’État, Opinion of 7 December 2017, no 393836, NOR:
JUSC1732261L.
7 Conseil Constitutionnel, Decision no 2018-765 DC of 12 June 2018, JORF 20 June 2018: NOR:
CSCL1816349S.
8 Act no 2018-493 of 20 June 2018, JORF 21 June 2018; Dossier (2018).
9 See, for example, a critical article: Martial-Braz (2018), p. 459.
10 Act no 2018-493 of 20 June 2018, Art. 32. Ordinance no 2018-1125 of 12 December 2018, JORF
13 December 2018. See in particular CNIL, Deliberation no 2017-299 of 30 November 2017,
CNILTEXT000036195647. See also Fauvarque-Cosson and Maxwell (2018), p. 1034; MartialBraz (2018), p. 459.
11 Le Gouvernement a fait le choix symbolique de ne pas abroger la loi fondatrice du 6 janvier 1978,
Explanatory Note to Act no 2018-493, p. 7.
12 See, for example, Hébert (2018), p. 9.
13 Desgens-Pasanau (2018b), p. 25.
14 Decrees nos 2017-1434, 2017-1435 & 2017-1436 of September 29, 2017, JORF 05 October
2017: entry in force on 1 January 2018 except the Decree no 2017-1435 which came into force on
1 January 2019.
160
L. Nicolas-Vullierme