II-11.4 : A Partnership on the “loi informatique et libertés“ (French Data Privacy Act) has been signed between the CNB (The French Bar Association) and the CNIL (the French Commission for Data Privacy)

www. http://cnb.avocat.fr

Context and Summary

Mr. Alex Türk, the President of the Commission nationale de l’informatique et des libertés (CNIL —French Commission for Data Privacy), and Mr. Thierry Wickers, the President of the Conseil national du barreau (CNB – the French Bar Association), signed a partnership on February 11, 2010, in order to take common action in the domain of educating lawyers on the “loi informatique et libertés” (French Data Privacy Act). This partnership plans to increase training of lawyers specialised in data privacy, and to augment representative organisations. Lawyers are seen as natural partners to take up such a function, which requires legal education and a large dose of independence. This is why the regulations applicable to lawyers were updated by a 2009 decision, which modified Article 6.2.2 of the regulations on lawyers specialised on data privacy, in order to define this role and to make it compatible with the deontological rules governing the profession.

The partnership also provides for the organisation of joint - education sessions on the provisions of the law for practicing and trainee lawyers. A directing committee will evaluate the steps taken in the partnership agreement.

Brief commentary

The status of Correspondant à la protection des données à caractère personnel (CPDCP – Data Privacy Specialist), also called Correspondant Informatique et Libertés (CIL), was created by the Act of August 6, 2004 (n° 2004-801), which modified the loi informatique, fichiers, libertés (Data Privacy Act) of 6 January 1978. This status corresponds to a person who is assigned to protect personal data, which was implemented by Article 18 of European Directive 96/46 of October 24, 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data. The French Decree (n° 2005-1309 of October 20, 2005) implementing this Directive defines the role of the CPDCP, who is responsible for ensuring the respect by a legal person (public or private) of the respect of the Data Privacy Law. Any legal person that hires a CPDCP is exonerated (at least partially, in function of the kinds of data being processed) from making declarations to the CNIL.