🌐follow Marie-Anne Frison-Roche sur LinkedIn

🌐subscribe to the Newsletter MAFR Regulation, Compliance, Law 

🌐subscribe to the Video Newsletter MAFR Surplomb

____

► Full Reference: M.-A. Frison-Roche, Who is responsible for making the Compliance provision effective? Is it the company or the public authority? Example of data: CE, 27 January 2025, B. c/ CNIL, Working Paper, February 2025.

____

🎤 This Working Paper was developed as a basis for the Overhang👁 video  on 8 February 2025 : click HERE (in French)

____

🎬🎬🎬In the collection of the Overhangs👁 It falls into the News category.

►Watch the complete collection of the Overhangs👁 : click HERE

____

► Summary of this Working Paper: In its decision of 27 January 2025, B. v CNIL, the French Administrative Supreme Court (Conseil d'État ) had to provide a solution to a case that the Compliance rules applicable to data had not expressly provided for. Can a person who believes that another person has failed to fulfill their obligations under the GDPR refer the matter to the French Data Protection Regulator (CNIL) and not the data controller?

The Conseil d'État considers that the question is clear and that there is no point in referring a preliminary question to the ECJ. Indeed, the texts require the person alleging that his or her right has been infringed to first contact the data controller to have the information deleted before subsequently referring the matter to the CNIL. Furthermore, this case involved personal information inserted by doctors in an expert report submitted to a court. The Conseil d'Etat agreed with the CNIL that it was not required to review and assess the evidence, which is the role of the court.

This shows that, while the right to alert can be used to refer cases directly to the administrative authorities, here the specific takes precedence over the general, with the spirit of the Law entrusting the direct preservation of rights to the data controller, with the CNIL's supervisory and sanctioning role coming only at a later stage. This illustrates the more general nature of Compliance Law, which relies primarily on the operators themselves. Furthermore, as a melting pot of various subjective rights, in this case the right to erasure but also the right to contribute to the debates, the Conseil d'Etat stresses that it is the role of the judicial judge to ensure the fairness of the debates.

____

🔓read the developments below⤵️