Investigations And Sanctions: What Lessons Can Be Drawn From The CNIL's Activities?

On April 15, the Commission Nationale de l’Informatique et des Libertés (French Data Protection Authority, hereinafter the "CNIL") presented its 2018 activity report, i.e. the assessment that it draws from its activities during the year 2018 which has been marked by the application of the General Data Protection Regulation and the new French Data Protection Act.

From the CNIL’s assessment and the decisions it took in 2018, we can learn lessons to prevent the risks incurred when processing personal data.

Lesson n°1

Almost one out of four investigations are triggered by a complaint or a report. The CNIL received a record number of complaints in 2018 (a 32.5% increase compared to the number of complaints in 2017 which according to the CNIL is due the media impact of the GDPR and increased public awareness). 73% of these complaints/reports concerned the exercise of a right.