law. This latter has already been greatly developed by the action of the Commission
Nationale de l’Informatique et des Libertés (CNIL)
15 and is bolstered by the Act of
20 June 2018, which creates new instruments “whose rule-making character is
graduated”
16 : drafting and publication of guidelines, recommendations, or benchmarks to facilitate compliance and prior risk-evaluation by processors’ controllers,
and publication of reference methodologies for processing activities.
Alongside this legislation there are numerous legal rulings: those of the CNIL,
and of French and European courts of law (the European Court of Human Rights
(ECHR) and the European Court of Justice (ECJ)).
Before the Ordinance of 12 December 2018, the article 2(2) LIL provided that:
“personal data means any data relating to a natural person who is identified or may
be identified directly or indirectly by reference to an identification number or to one
or more elements specific to that person. In determining whether a person is
identifiable, consideration should be given to all means for enabling their identification that are available to the controller or any other person, or to which they may
have access.”
This definition derives from the LIL as amended by the Act of 2004. Initially, the
text covered “nominative information”. The lawmaker subsequently replaced that
expression by “nominative data” before coming to refer to “personal data”.
With the Ordinance, the LIL includes now a cross-reference to the definition of
“personal data” contained in the GDPR.
Further to the judgment of the ECJ of 19 October 2016, which held that an IP
address referred to an identifiable natural person,
17 the Cour de Cassation in turn
found on 3 November 2016 that an IP address was personal data.
18 The same applies
to a MAC address.
19
For want of any right to personal data protection being enshrined in the French
Constitution of 1958,
20 the Conseil Constitutionnel recognized such a right on the
basis of the right to respect of privacy.
21 This right is guaranteed by article 2 of the
Declaration of the Rights of Man and the Citizen of 1789. Several decisions take up
the same grounds:
15 Falque-Pierrotin (2013), p. 239; Bourgeois (2017), pp. 15 ff.
16 See for example the baseline methodology in the matter of health: MR-001. Explanatory
statement, p. 8.
17 ECJ 19 October 2016, C 582/14, ECLI:EU:C:2016:779.
18 Decision of the first Civil Chamber of Court of Cassation, 3 November 2016, pourvoi no
15-22595, ECLI:FR:CCASS:2016:C101184. Fauchoux et al. (2017), no 333.
19 CNIL, Deliberation no 2016-053 of 1 March 2016: CNILTEXT000032168674.
20 See Martial-Braz (2018), p. 459.
21 Conseil Constitutionnel, Decision no 2012-652 DC of 22 March 2012, no 8. ECLI:FR:CC:2012:
2012.652.DC.
Data Protection in the Internet: French Report
161
Nationale de l’Informatique et des Libertés (CNIL)
15 and is bolstered by the Act of
20 June 2018, which creates new instruments “whose rule-making character is
graduated”
16 : drafting and publication of guidelines, recommendations, or benchmarks to facilitate compliance and prior risk-evaluation by processors’ controllers,
and publication of reference methodologies for processing activities.
Alongside this legislation there are numerous legal rulings: those of the CNIL,
and of French and European courts of law (the European Court of Human Rights
(ECHR) and the European Court of Justice (ECJ)).
Before the Ordinance of 12 December 2018, the article 2(2) LIL provided that:
“personal data means any data relating to a natural person who is identified or may
be identified directly or indirectly by reference to an identification number or to one
or more elements specific to that person. In determining whether a person is
identifiable, consideration should be given to all means for enabling their identification that are available to the controller or any other person, or to which they may
have access.”
This definition derives from the LIL as amended by the Act of 2004. Initially, the
text covered “nominative information”. The lawmaker subsequently replaced that
expression by “nominative data” before coming to refer to “personal data”.
With the Ordinance, the LIL includes now a cross-reference to the definition of
“personal data” contained in the GDPR.
Further to the judgment of the ECJ of 19 October 2016, which held that an IP
address referred to an identifiable natural person,
17 the Cour de Cassation in turn
found on 3 November 2016 that an IP address was personal data.
18 The same applies
to a MAC address.
19
For want of any right to personal data protection being enshrined in the French
Constitution of 1958,
20 the Conseil Constitutionnel recognized such a right on the
basis of the right to respect of privacy.
21 This right is guaranteed by article 2 of the
Declaration of the Rights of Man and the Citizen of 1789. Several decisions take up
the same grounds:
15 Falque-Pierrotin (2013), p. 239; Bourgeois (2017), pp. 15 ff.
16 See for example the baseline methodology in the matter of health: MR-001. Explanatory
statement, p. 8.
17 ECJ 19 October 2016, C 582/14, ECLI:EU:C:2016:779.
18 Decision of the first Civil Chamber of Court of Cassation, 3 November 2016, pourvoi no
15-22595, ECLI:FR:CCASS:2016:C101184. Fauchoux et al. (2017), no 333.
19 CNIL, Deliberation no 2016-053 of 1 March 2016: CNILTEXT000032168674.
20 See Martial-Braz (2018), p. 459.
21 Conseil Constitutionnel, Decision no 2012-652 DC of 22 March 2012, no 8. ECLI:FR:CC:2012:
2012.652.DC.
Data Protection in the Internet: French Report
161