A French bill “to better guarantee the right to privacy in the digital age” has implemented the European Directive 2009/136/EC by requiring the data controller to inform the “Data Protection Correspondent” (a person within an organization who could be the controller or someone assisting the controller), or in the absence thereof, the French data protection authority (the Commission Nationale de l’Informatique et des Libertés), of a breach of integrity or confidentiality. Those involved in the breach must also be informed, at least if security breaches are “likely to adversely affect” their personal data. The bill follows the recommendation of the Directive to notify individuals of security breaches for all sectors, not just electronic communications. It was adopted by the French Senate on March 24, 2010 and is currently before the National Assembly.
(A French version of this article is also available in this blog.)
Filed under Cédric Laurant, Comments, Countries, English, EU Law, Europe, European Union, France, Marie-Andrée Weiss · Tagged with Act No. 78-17 of January 6 1978, Act on Data Processing Data Files and Individual Liberties, California, California Office of Privacy Protection, California Security Breach Notification Act, CNIL deliberation No. 81-94 of July 21 1981, Commission nationale de l’informatique et des libertés, contract, contractual clauses, data breach, data confidentiality, data controller, data protection correspondent, data security, data security breaches, EU Directive 2002/58/EC, EU Directive 2009/136/EC, French Data Protection Act, French Data Protection Authority, French National Assembly, French Senate, general IT security measures, personal data, security breach, security breach notification, technological protection measures, unauthorized access, United States
La proposition de loi française “visant à mieux garantir le droit à la vie privée à l’heure du numérique” transpose la Directive 2009/136/CE en obligeant les responsables de traitements de données à caractère personnel d’informer le correspondant “informatique et libertés” ou, en son absence, l’autorité de protection de la vie privée (la CNIL), d’une violation de l’intégrité ou de la confidentialité de ces traitements, ainsi que les personnes concernées par cette violation, du moins si les failles de sécurité sont “de nature à affecter négativement” leurs données à caractère personnel. Elle suit également la recommandation de la directive européenne de notifier aux particuliers les violations de sécurité pour tous les secteurs, pas seulement celui des communications électroniques. Elle a été adoptée par le Sénat français depuis le 24 mars 2010 et est actuellement devant l’Assemblée nationale.
(An English version of this article is also available in this blog.)
Filed under Cédric Laurant, Comments, Countries, EU Law, Europe, European Union, Français, France, Law, Marie-Andrée Weiss · Tagged with accès non autorisé, Assemblée nationale française, California Office of Privacy Protection, California Security Breach Notification Act, Californie, CNIL, Commission nationale de l’informatique et des libertés, confidentialité des données, correspondant "informatique et libertés", délibération de la CNIL, délibération de la CNIL n°81-94 du 21 juillet 1981, Directive européenne 2002/58/CE, Directive européenne 2009/136/CE, données à caractère personnel, droit à la vie privée, France, loi "Informatique et libertés", loi no. 78-17 du 6 janvier 1978, mesures générales de sécurité des systèmes informatiques, proposition de loi, responsable du traitement, sécurité des données, Sénat français, violations de sécurité
Will France adopt a law requiring the notification of security breaches?
Posted by "Security Breaches" Administrator on August 6, 2010 · 3 Comments
A French bill “to better guarantee the right to privacy in the digital age” has implemented the European Directive 2009/136/EC by requiring the data controller to inform the “Data Protection Correspondent” (a person within an organization who could be the controller or someone assisting the controller), or in the absence thereof, the French data protection authority (the Commission Nationale de l’Informatique et des Libertés), of a breach of integrity or confidentiality. Those involved in the breach must also be informed, at least if security breaches are “likely to adversely affect” their personal data. The bill follows the recommendation of the Directive to notify individuals of security breaches for all sectors, not just electronic communications. It was adopted by the French Senate on March 24, 2010 and is currently before the National Assembly.
(A French version of this article is also available in this blog.)
Rate this:
Filed under Cédric Laurant, Comments, Countries, English, EU Law, Europe, European Union, France, Marie-Andrée Weiss · Tagged with Act No. 78-17 of January 6 1978, Act on Data Processing Data Files and Individual Liberties, California, California Office of Privacy Protection, California Security Breach Notification Act, CNIL deliberation No. 81-94 of July 21 1981, Commission nationale de l’informatique et des libertés, contract, contractual clauses, data breach, data confidentiality, data controller, data protection correspondent, data security, data security breaches, EU Directive 2002/58/EC, EU Directive 2009/136/EC, French Data Protection Act, French Data Protection Authority, French National Assembly, French Senate, general IT security measures, personal data, security breach, security breach notification, technological protection measures, unauthorized access, United States