skip to content
 

Data Protection Laws and Freedom of Expression: France Flag of France

 

 

I. First-Generation Statutory Law

 
Special Expression Derogation
This Act established limited derogation in favour of the processing by the bodies of the written or audio-visual press which lifted the prohibition on processing sensitive personal data and the need to obtain authorization for transborder data flows but only when their application would limit freedom of expression and all other applicable legal restrictions were adhered to (both within and outside of statutory data protection itself) (art. 33).
 
Broad Expression Derogation
No freedom of expression derogations were included outside of the media.
 
Personal Exemption
No personal exemption was included.
 
Knowledge Facilitation Framework
France did not include any specific knowledge facilitation provision in its first-generation data protection act.
 
Parliamentary Debates
Special Expression Derogation
Jean Foyer, the President of the Constitutional Law Commission, noted that there was a very high number of private files in existence, including those stored by the Press. These press files should be exempted from prohibitions relating to the retention of sensitive data on political opinions, origins, religious or philosophical beliefs or trade union affiliations.[1] The Minister of Justice similarly noted that it was necessary to adequately reconcile citizens’ freedom and the new freedoms created by information technologies. How to reconcile these freedoms would have to be a deliberate choice of the parliament.[2]
Raymond Forni (Socialist Party, opposition) introduced an amendment addressing derogations from certain articles in favour of written or audiovisual media if their application would otherwise limit the freedom of expression. He explained that this article would address the export of data, the retention of details of criminal offences and the reporting on political or trade affiliations, religious opinions and racial origins by the media. Forni further elaborated that the Press was subject to very strict regulation. A failure to exclude them from the application of the articles 22, 25 and 26 of the proposed law would practically suppress the circulation of a certain number of news reports. It would, after all, be in the nature of the media to transmit news across borders and write about political personalities which may include sensitive information. Foyer countered that the adoption of this proposed amendment would leave a gap in the law. However, the amendment was subsequently adopted.[3]
Before the vote on the adoption of the law, Foyer complained that the amendment profoundly upset the system, giving preference to the freedom of the press over the individual liberty and protection of the private life of citizens. Despite this, the law was subsequently adopted.[4]
 
No further relevant debates were recorded.
 

II. Second-Generation Statutory Law

France amended the 1978 Act on Data Processing, Files and Individual Liberties in order to transpose Directive 95/46 on 6 August 2004.  It also adopted Decree No 2005-1309 on 20 October 2005.
 
Special Expression Derogation
France set out a broadly applicable permissive special expression derogation based on public interest. Specifically, French law provided for a professional journalistic derogation from the data quality provision requiring personal data to be kept in a form that permits identification of data subjects for no longer than is necessary (but not the other data quality provisions), the transparency rules, the sensitive data regime and the data export condition so long as processing is ‘according to the ethical rules of this profession’.Exemption from notifying processing with the Data Protection Authority (DPA) was made conditional on the appointment and notification of an internal data protection officer responsible for maintaining a register of processing and independently ensuring the proper application of the Act. As regards DPA supervision it was stated that (i) should the Act not be complied with them the controller shall be ordered by the DPA to bring about conformity and (ii) in the event of the officer failing to perform his/her duties then they should be discharged at either the request or after consultation with the DPA (Act No 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (as amended by Act of 6 August 2004), art. 67).
 
France enacted non-journalistic special expression derogations which were less stringent than those applicable to the institutional media. In sum, literary and artistic expression was granted an absolute exemption from notifying processing with the DPA and, furthermore, the benefit of the other derogations was, in contrast to journalism, not made subject to the following of the ‘ethical rules’ of any profession (art. 67).
 
Broad Expression Derogation
No special provision.
 
Personal Exemption
Art. 2 excluded the processing of personal data carried out for the exercise of exclusively private activities.
 
Knowledge Facilitation Framework
The French Act set out limited knowledge facilitation derogations for statistical, scientific and historical purposes. In particular, the French law provided an exemption from the compatibility principles so long as the data was not used to take decisions with respect to data subjects (s. 6(2)) and the application of time-limits to data stored for the processing of personal data for historical, statistical and scientific purposes (art. 36). Derogations from the sensitive data rules were only available for medical research and public sector statistics both following DPA authorisation (art. 8(2)(7) and 8(2)(8)).  In the case of medical research, the request required approval of a ministerial advisory committee  but this could be assumed if no reply with one month and DPA authorisation could be on the basis of a general standard so long as data was pseudonymized (art. 54).  It all cases it was stipulated that the presentatoin of results must be anonymized, there must be a right to object and there must be individual notification of each subject unless information was deliberately kept from the subject to a grave diagnosis etc. or they could not longer been located and this was flagged to the DPA (arts. 55-57).  Derogations from the proactive indirect transparency rule were permitted if the conditions set out in the Heritage Code were met (art. 32(III)). Special rules were applicable to archives, which were exempted from the temporal limitations and incompatibility provisions, and from the retroactive transparency rules if all risk of violating privacy of a data subject was excluded and a necessity test is met (art. 36). Chapter IV of the data protection decree set out more specific provisions on medical research. It namely provided for the appointment of an Advisory Committee to which applications for the processing of personal data for the purpose of medical research shall be submitted. This Advisory Committee set the conditions under which processing of personal data for medical research purposes was permitted. In particular, Art. 36 sets out the methods of granting an affected data subject access rights; Art. 38 provides that a person may express her objection to the processing of her data by any means; and Art. 39 related to the research with identifiable biological samples, which require prior written consent by the affected data subject.
Parliamentary Debates
Special and Broad Expression Derogation
During the National Assembly debate, Gérard Gouzes, the rapporteur for the Constitutional Law Commission, in a general statement argued that in relation to the press and the journalistic profession, the bill encouraged self-regulation and gives the DPA a new mandate to evaluate and negotiate deontological rules. The rules should be more rigorous, focusing on the purpose of the files. Sensitive data, otherwise not allowed to be processed, should be protected by a system of authorization.[5] MP Alex Türk, who was the rapporteur on the draft law and later became President of the DPA, proposed an amendment confirming that the processing of sensitive data, including data on crimes and convictions, for journalistic purposes was not prohibited.[6] This amendment was adopted without further discussion. In a report on the draft, MP Türk also expressed worries about the consequences for a data subject’s right to his or her image in light of a recent court decision rendered in first instance. The court namely decided that an artist’s use of a photograph of a person taken without that person’s consent did not constitute an infringement of his or her rights. MP Türk called for an evolution of this point.[7]
Newly added derogations granted in favour of literary and artistic expressions were justified on the basis that the line between journalistic and artistic or literary forms of expression had become blurred. As Guy Braibant, a member of the Commission Supérieure de Codification, highlighted in a report to the Prime Minister, there is little difference between a series of articles on a political personality and a book on the same subject.[8]
 
Moreover, during the committees proceedings, it was stated that there was clearly a contradiction between the protection of private life and personal data and the exercise of freedom of expression essential in a democratic society.  It was noted that in 1995 the DPA had addressed this conflict and called for certain amendments of the law. At the time, it was recommended that the security of the data processed should be ensured, that any legal actions, rectifications and responses that have taken place should be published with the data and that each press organization should appoint a correspondent with the CNIL. This recommendation, however, was not legally binding and did not have any effect.[9] Similarly, the CNIL recommended that any legal actions, including rectifications, of data should be published with the data, and that each media organization should appoint a person responsible for liaising with the CNIL.[10]
 
Broad Expression Derogation
As regards the broader concept of freedom of expression, MP Patrice Martin-Lalande argued that the production of online content, such as computer programmes and video games, must be protected and compensated, going beyond the mere protection of music.[11]
 
Personal Exemption
No debate.
 
Knowledge Facilitation Framework
MP Jean Codognès observed that the processing of health data for research purposes was subject to both an ex ante and an ex post control by the DPA to reconcile the need for access to such data for scientific progress and the confidentiality of patient data. In comparison to the 1978 law, this proposed regime would reduce the control of the DPA to the processing of data posing a serious threat to the rights of individuals.[12]
MP Patrice Martin-Lalande introduced an amendment clarifying what anonymization of data in this context would mean. He elaborated that data can be considered to be anonymized if a person is not identifiable using all reasonably available means. Such anonymization should be encouraged, particularly in the context of processing of data for statistical and scientific purposes. He later withdrew his amendment after a confirmation by rapporteur MP Gérard Gouzes that anonymization would be taken into account later in the text.[13]
MP Pascal Clément proposed an amendment to preserve the regime of implicit authorization of processing of health data for research purposes by the CNIL. MP Gérard Gouzes intervened in favour of the proposed provision which requires express authorization by the DPA in line with the Directive which conceives health data as part of the category of sensitive data. To preserve the then applicable article requiring implicit authorization of the processing of health data for research purposes would, moreover, be contrary to a decision of the Constitutional Council which required express authorization. MP Gouzes did, however, concede that the proposed article would restrict an accelerated processing of health data for research purposes. After this exchange, the amendment was withdrawn.[14]
MP Türk then took up the issue of anonymization again, emphasizing the importance of anonymous data for the development of information technologies. An amendment aimed at subjecting the processing of data for scientific, historical and statistical purposes to the condition of anonymization without exemption was rejected as too radical, stifling in particular scientific research.[15]
 

III. Third-Generation Statutory Law

France amended the 1978 Act on Data Processing, Files and Individual Liberties Ordinance No. 2018-1125 on 12 December 2018.
 
Special Expression Derogation
France sets out a professional journalistic exemption from, in this case, the temporal minimization of data, the transparency and sensitive data rules, and the data export restrictions. This is subject to a double qualification, namely, that processing be in accord with the ‘ethical rules of the profession’ and that any derogation must be ‘necessary to reconcile the right of the protection of personal data and freedom of expression and information’.
A similar statutory derogation is established for academic, artistic and literary expression but this does not require conformity to any cognate to the professional ethical rules that it required of the journalistic media. Any derogation must still, however, satisfy a necessity test (Ibid, art. 80).It is explicitly stated none of these provisions prevent application of this provisions on the right of reply or which address attacks on the privacy and reputation of individuals as setout in the Civil Code, the laws on the written or audiovisual press and the penal code. (Act No 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (as amended by Ordinance 2018-1125), art. 80) The prohibition on the DPA using its regulatory powers to seize data protected under confidentiality only applies to journalistic as opposed to other expressive material (Ibid, art. 19(2)).
These provisions do not expressly establish the priority of the special expression derogation over the Knowledge Facilitation Framework.
 
Broad Expression
No special provision.
 
Personal Exemption – see GDPR, art. 2(2)(c)
 
Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
France amended the existing regulation of processing of personal data for ‘historical, statistical and scientific purposes’ .  The Act dos not set out any derogation from the sensitive data rules other than in the area of health research.  Aside from limited situations not relevant in this context, processing of any personal data concerning health must comply with standards established by the DPA in consultation with the National Institute for Health Data and require a decision of the DPA (which must take place within two months unless extended by reasoned decision by a further two months which, if not forthcoming, will be taken as having authorised processing) (art. 65).  The Act excludes automated processing of genetic data for research purposes absent the express and informed consent of the persons concerned unless this is covered by article L 1131-1-1 of the public health code (art. 75).   Art. 78 provides that Arts. 15, 16, and 18 to 21 of the GDPR do not apply to the processing of personal data for archival purposes, to the extent that these rights make it impossible or seriously hinder the achievement of these archival purposes. The safeguards provided for in Art. 89 GDPR are declared to be those set out in the Heritage Code.  This provision further provides that, following a reasoned and published opinion of the DPA, a Council of State decree can establish limitations here (other than in relation to art. 19 and 20) for scientific or historical research purposes and for statistical purposes.  Article 79 specifically provides that under the conditions of article 14(5)(b) the other provisions of article 14 of the GDPR do not apply to any of these knoweldge facilitation purposes when the personal data were initially collected for another purpose.
Parliamentary Debates
Special Expression Derogation
There were no debates on the special expression derogation.
 
Broad Expression Derogation
The right to be forgotten was briefly discussed following a proposed amendment to art. 40 of the draft law which aimed at deleting the words ‘when the person concerned was a minor at the time of collection’. Pursuant to MP Sylvie Robert, the right to be forgotten must be weighed against other rights, including the right to information and to scientific research. However, she maintained that the application of the right to be forgotten to personal data collected before the affected data subject reaches the age of 18 was arbitrary. MP Sophie Joissans, who was also a Rapporteur on the Law, countered that this amendment was superfluous as the GDPR was directly applicable and provided for the right to be forgotten without any such age restrictions. Nicole Belloubet, the Keeper of the Seals, agreed with MP Joissans. The amendment was subsequently withdrawn.[16] No further relevant discussions took place with regard to broad expression.
 
Knowledge Facilitation Framework
MP Rémy Rebeyrotte noted that much has been done to find an appropriate balance between access to data for scientific and innovation purposes and the protection of the individual.[17] MP Laure de La Raudière emphasized the importance of data for medical research and the development of preventative medicine. MP Cédric Villani similarly pleaded for a simplified and less restricted access to data for research and scientific purposes.[18] MP Emmanuelle Ménard criticized that the proposed draft provision allowing access to medical data for research and diagnostical purposes would essentially abandon the medical secret. She accordingly argued that it should be made clear that such access would only be allowed if the respective patient expressly consented thereto. MP Ménard’s proposed amendment was, however, rejected with reference to the responsibility of the DPA to control the processing of personal data for such purposes.[19]
MP Loïc Prud’homme criticized the vagueness of the terms ‘scientific’, ‘historic’ and ‘statistical’ research purposes which would allow vast amounts of data to be processed for purposes other than what they were collected for. However, his amendment to change art. 12 was not supported by the government and consequently not adopted.
In the Senate’s debate, Jérôme Durain similarly criticized the more relaxed conditions for accessing medical data for research purposes.[20] An amendment introduced by a group of MPs aimed at clarifying that such access to medical data for research purposes would only be allowed after the respective patient has been informed. The government insisted that the consent of the respective doctor and the control of the DPA would be sufficient. The amendment was not adopted.[21]
Another amendment concerned the right to rectify historical data. It was proposed by the government that historical archives should be exempted from this right as this would jeopardise the integrity of the records. The amendment was subsequently adopted.[22]
 

[1] National Assembly Debates, 1978 Law “Information Technology and Civil Liberties” First reading  1st session of Tuesday 4th October 1977, http://www.assemblee-nationale.fr/histoire/informatique-et-libertes/sommaire.asp p.4-8.
[2] National Assembly Debates, 1978 Law “Information Technology and Civil Liberties” First reading  1st session of Tuesday 4th October 1977 http://www.assemblee-nationale.fr/histoire/informatique-et-libertes/so mmaire.asp p. 23-24; also Report of the Senate, http://www.senat.fr/rap/l77-3125/l77-31251.pdf (last accessed 4 December 2020).
[3] National Assembly Debates : 1978 Law “Information Technology and Civil Liberties” 2nd session Thursday 5th October 1977, p. 5881, http://archives.assemblee-nationale.fr/5/cri/1977-1978-ordinaire1/005.pdf
[4] Ibid.
[5] National Assembly Debates on 2004 Law, First Reading, 30th January 2002, La Liberté d’Expression, p.1039.
[6] Senate First Reading, 1st April 2003 p. 114 p.154 – 155.
[7] Law Commission, ‘Protection of Individuals with Regard to the Processing of Personal Data and Amending Law No. 78-17 of 6 January 1978 relating to Data Processing, Files and Freedoms—Examination of the report at Second Reading’ (23 June 2004) http://www.senat.fr/commission/loi/lois040625.html#toc4 (last accessed 11 April 2021).
[8] Report of the Commission for Constitutional Laws, Legislation and General Administration of the Republic on Bill no. 3250 on the Protection of Private Persons Concerning the Processing of Personal Data and Modifying Law no. 78-17 of 6 January 1978 on Information Technology, Files and Civil Liberties, p.78.
[9] Decision n° 95-012 of 24 January 1995 relating to personal details processed or used by the written or audiovisual press for journalistic and composition purposes.
[10] Decision n° 95-012 of 24 January1995 relating to personal details processed or used by the written or audiovisual press for journalistic and composition purposes.
[11] National Assembly Debates on 2004 Law, First Reading, 30th January 2002,  La Presse; l’Audiovisuel, p. 1049.
[12] National Assembly Debates on 2004 Law, First Reading, 30th January 2002,  La Presse; l’Audiovisuel, p. 1045, no elaboration as to what is considered to be serious or dangerous.
[13] National Assembly Debates on 2004 Law, First Reading, 30th January 2002,  La Presse; l’Audiovisuel, p. 1058.
[14] National Assembly Debates on 2004 Law, First Reading, 30th January 2002,  La Presse; l’Audiovisuel 1076  p. 1078-1079.
[15] Senate First Reading, 1st April 2003 p.72.
[16] Sénat, ‘Séance du 21 mars 2018 (compte rendu integral des débats)’ (21 March 2018) https://www.senat.fr/seances/s201803/s20180321/s20180321_mono.html (last accessed 4 April 2021).
[17] Rémy Rebeyrotte, ‘Assemblée nationale XVelegislature, Session ordinaire de 2017-2018, Compte rendu integral, Première séance’ (6 February 2018) http://www.assemblee-nationale.fr/15/cri/2017-2018/20180134.asp (last accessed 14 August 2020).
[18] Ibid.
[19] Ibid.
[20] Sénat, ‘Séance du 21 mars 2018 (compte rendu integral des débats)’ (21 March 2018) http://www.senat.fr/seances/s201803/s20180321/st20180321000.html (last accessed 14 August 2020).
[21] Ibid.
[22] Ibid.