News

CNIL facilitates the use of outsourcing services performed in France on behalf of non-European companies

15 March 2011

In a context of globalisation, the Commission is regularly confronted with situations where non-European companies contract French providers. The latter take over the management of their employees or the management of their clients and prospects files.

These companies established outside the European Union use processing means in France and, as a result, have to comply with the French Data Protection Act.

Nevertheless, the Commission wanted to be realistic and pragmatic in applying the French law to such situations. The aim is to ensure a high level of protection of personal data while, at the same time, generating practical solutions in order not to hamper the development of service provisions propositions by French companies.

Thus, the Commission decided to exempt from declaration the processing of human resources, client management and prospects files. This exemption relates to the processing performed by French service providers on behalf of data controllers established outside the EU. It thus simplifies the notification obligations of the latter.

Moreover, it was also decided, on the basis of the exceptions under Article 69 (paragraphs 5 and 6) of the French Data Protection Act, to facilitate transborder data flows "back" to these non-European companies. The risks to the privacy of the data subjects, resulting from these transfers, are limited as these non-European companies, first and foremost, collect personal data in their own country, i.e. outside the EU.

CNIL wishes to encourage a reflection on how to improve and make more effective the rules relating to the national applicable law. The revision of the EU Directive, currently in progress, certainly provides a unique opportunity to embark on this path.