Status & Composition
An Independent Administrative Authority
Created in 1978, the CNIL is an independent administrative authority that exercises its functions with accordance to the French Data Protection Act of the 6th of January 1978, amended the 6th of August 2004.
The CNIL’s independence is guaranteed by its composition and its organization. The seventeen members that form the commission are for the most part elected by the assemblies and jurisdictions to which they belong. The CNIL elects its chairperson amongst its members and does not receive any instructions by any other authority to the election of the chair.
- 4 Parliamentarians (2 Assembly members, 2 Senators)
- 2 members of the French Economic, Social and Environmental Council
- 6 representatives of high jurisdictions (2 State Council members, 2 members of the Court of Cassation and 2 members of the Audit Court)
- 5 qualified public figures appointed by: the President of the National Assembly (1 public figure), the President of the Senate (1 public figure), the French Cabinet (3 public figures). The mandate of the commissioners is for 5 years, or, for parliamentarians, as long as the duration of their mandate.
The members of the CNIL congregate in plenary sessions once a week on an agenda pre-established by the Chair. A major part of these sessions is devoted to the assessment of bills and draft decrees that are submitted by the government for an official CNIL opinion. Additionally, the CNIL gives authorisations for the processing of sensitive data including, but not limited to, those requesting the use of biometrics. It also analyses the consequences of new technologies on citizens’ private life.
Since the law of the 6th of August 2004, the CNIL’s restricted committee, which is composed of 5 members and a Chair other than the CNIL’s Chair, can render diverse sanctions on data controllers who do not respect the law. The amount of the penal sanctions can reach up to €300,000. These penal sanctions can also be made public.