Page 1

Decree n ° 2019-536 of May 29, 2019 taken for the application
of the law n ° 78-17 of January 6, 1978 relating to
IT, files and freedoms
Data last update for this text: May 16, 2020
NOR: JUSC1911425D
Version in force on 06 June 2021

The Prime Minister,
On the report of the Keeper of the Seals, Minister of Justice,
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to
the protection of individuals with regard to the processing of personal data
personnel and the free movement of such data, and repealing Directive 95/46 / EC;
Having regard to Directive (EU) 2016/680 of the European Parliament and of the Council of April 27, 2016 relating to
the protection of individuals with regard to the processing of personal data
personnel by the competent authorities for the purpose of preventing and detecting infringements
criminal proceedings, investigations and prosecutions in the matter or the execution of criminal sanctions, and the
free movement of such data, and repealing Council Framework Decision 2008/977 / JHA;
Considering the code of social action and families;
Having regard to the defense code;
Considering the code of administrative justice;
Having regard to the code of judicial organization;
Having regard to the heritage code;
Having regard to the penal code;
Having regard to the code of criminal procedure;
Having regard to the code of relations between the public and the administration;
Having regard to the public health code;

Page 2

Having regard to the internal security code;
Considering the law of July 29, 1881 on freedom of the press;
Considering the law n ° 51-711 of June 7, 1951 on the obligation, the coordination and the secrecy as regards
statistics ;
Considering the law n ° 78-17 of January 6, 1978 relating to data processing, files and freedoms, in its
drafting resulting from ordinance n ° 2018-1125 of 12 December 2018 taken in application of
article 32 of law n ° 2018-493 of 20 June 2018 relating to data protection
personal and amending the law n ° 78-17 of January 6, 1978 relating to data processing,
files and freedoms and various provisions concerning the protection of data at
personal character;
Considering the amended penitentiary law n ° 2009-1436 of November 24, 2009;
Considering the law n ° 2017-55 of January 20, 2017 relating to the general statute of the administrative authorities
independent and independent public authorities;
Considering the law n ° 2019-222 of March 23, 2019 of 2018-2022 programming and reform for the
justice;
Considering the ordinance n ° 45-174 of February 2, 1945 modified relating to delinquent children;
Considering the decree n ° 2006-781 of July 3, 2006 fixing the conditions and the methods of payment of
costs incurred by the temporary travel of State civilian personnel;
Considering the decree n ° 2018-232 of March 30, 2018 taken for the application to the National Commission of
data processing and freedoms of the law n ° 2017-55 of January 20, 2017 on the general statute of
independent administrative authorities and independent public authorities;
Considering the deliberation n ° 2019-055 of May 9, 2019 bearing the opinion of the National Commission of
information technology and freedoms;
Having regard to the opinion of the Government of New Caledonia dated May 7, 2019;
Having regard to the opinion of the government of French Polynesia dated May 16, 2019;
After hearing the Council of State (interior section),
Decrees:

Title I: COMMON PROVISIONS (Articles 1 to 70)
Chapter I: The National Commission for Information Technology and Civil Liberties (Articles 1 to
60)

Page 3

Section 1: Composition and functioning (Articles 1 to 15)
Article 1

Members of the National Commission for Informatics and Freedoms
mentioned in 2 °, 3 °, 4 °, 5 °, 6 ° and 7 ° of I of article 9 of the law of January 6, 1978
abovementioned are renewed by half every two years and six months.
Article 2

The members of the National Commission for Informatics and Freedoms are
convened by its president. The convocation is of right at the request of the third party
members of the committee. The convocation specifies the agenda.
Article 3

The committee can only validly deliberate if the majority of its members
in exercise participates in the session.
Article 4

The deliberations of the committee are taken by an absolute majority of
members present.
However, are taken by an absolute majority of the members composing the
committee, meeting in plenary, the following deliberations:
1 ° The election of the vice-presidents, including that of the deputy vice-president;
2 ° The adoption of the internal regulations;
3 ° The opinions issued by the commission when it is informed of the creation of
treatments mentioned in articles 31 and 32 of the aforementioned law of 6 January 1978;
4 ° The guidelines, recommendations or standards and the methodologies
of reference mentioned in b, as well as the standard regulations mentioned in c of
2 ° of I of article 8 of the same law;

Page 4

5 ° Decisions developing or approving the criteria for the benchmarks
certification and approval mentioned in h of 2 ° of I of article 8 of the same law
;
6 ° The authorizations issued by the commission, when it is seized of the
creation of treatments of section 3 of chapter III of title II of the same law;
7 ° The standard contractual data protection clauses mentioned in
Article 28 and Article 46 of the aforementioned Regulation (EU) 2016/679;
8 ° The decisions and opinions relating to the codes of conduct mentioned in 5 of
article 40 of the same regulations;
9 ° The treatment lists mentioned in 4 and 5 of article 35 of the same
regulation and in k of 2 ° of I of article 8 of the same law.
Article 5

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
I. - The chairman of the committee and the deputy vice-chairman may, after
having informed the plenary session of the committee, delegating
secretary general to sign the following acts only:

1 ° All acts having as their object:

a) The closing of a due diligence pursuant to g of 2 ° of I of article
8 of the aforementioned law of January 6, 1978;

b) In accordance with the prior consultation procedure provided for in Article 36 of the
Regulation (EU) 2016/679 of April 27, 2016 referred to above, to send a written notice to
data controller;

c) Renewal of the notice period pursuant to article 38
of this decree;

Page 5

d) The appointment of an expert or a doctor in application of Articles 35 and 36
of this decree;

e) The extension of the deadlines mentioned in 2 of Article 36 of Regulation (EU)
2016/679 of April 27, 2016 referred to above, in article 34 and in V of article 66 of the law of
January 6, 1978, as well as in articles 9, 72, 73, 74, 125 and 130 of this decree;

f) Referral to the ethics and scientific committee for research, studies and
evaluations in the field of health pursuant to Article 92 of the
this decree;

2 ° Any act having as its object the observation of compliance with the conditions mentioned in
4 of article 34 of the aforementioned regulation (EU) 2016/679 of April 27, 2016;

3 ° All acts having as their object the communication and dissemination of documents
administrative;

4 ° All acts intended to exercise the powers mentioned in d of 2 °
of I of article 8 of the aforementioned law of 6 January 1978 and 9 of article 60 of
Regulation (EU) 2016/679 of April 27, 2016 referred to above.

II. - By delegation of the chairman of the committee, the secretary general may
sign all acts relating to the recruitment, management and remuneration of the
commission staff, the management of its budget as well as all contracts and
conventions necessary for its operation.

III. - Under the conditions set by the chairman of the committee, the secretary
general can delegate to the supervisory staff placed under his
authority to sign, within the limits of their powers, all acts for
which he himself received a delegation of signature in application of 2 °, of
3 ° and 4 ° of I and II.

Page 6

The agents mentioned in the previous paragraph may themselves give
delegation to sign all acts relating to matters for which they have
themselves received delegation:

1 ° Category A agents placed under their authority for the acts mentioned
in 3 ° of I and in II;

2 ° To the agents responsible for the investigation of the cases mentioned in 4 ° of I.

IV. - These delegations are exercised under the authority of the president and the vice-president
delegate as well as, if necessary, under the authority of the hierarchical superior
immediately from the agents concerned.

V. - These delegations are published on the website of the National Commission
computing and freedoms.
Article 6

The members of the commission elect from among themselves by an absolute majority of
members of the committee the chairman, the vice-chairman and the four
other members of the restricted formation under the conditions provided for in article 9
of the law of January 6, 1978 referred to above.
The commission can only validly proceed with this election if the majority
current members of the committee participate in the meeting.
When one of the members elected from the restricted formation ceases to exercise
his functions during his term of office, he is replaced under the conditions defined in the
previous paragraphs.
The restricted formation can validly deliberate only if at least four of
its members, including the president or vice-president, are present.
Article 7

Page 7

Expenses are authorized by the president of the commission or by the
deputy vice-president.
Article 8

The members of the committee are entitled to reimbursement of the costs that
requires the execution of their mandate, under the conditions provided for by the decree of
July 3, 2006 referred to above.
The personnel who are called upon to assist the commission are entitled to,
under the conditions of the previous paragraph, to the reimbursement of expenses incurred
the occasion of the missions carried out on behalf of the commission.
Article 9

I. - The National Commission for Informatics and Freedoms, referred to within the framework
of a of 4 ° of I of article 8 of the aforementioned law of 6 January 1978, decides
within two months from the date of receipt of the
request for an opinion. This period may be extended by one month upon a reasoned decision from the
chairman of the committee.
In case of emergency, this period is reduced to one month at the request of the Government.
when the committee is seized of bills or decrees or any
provision of bill or decree.
II. - Opinions intended for the President of the National Assembly, the President of the
Senate, parliamentary committees of the National Assembly and the Senate or
to parliamentary group chairmen can be published by their recipient
or, with the agreement of the latter, by the National Commission for Informatics and
freedoms.
III. - The commission, seized within the framework of e of 2 ° of I of article 8 of the same
law, or on the basis of any other legislative provision providing that an act
regulation is taken after the committee's opinion, gives a decision within the
two months from the date of receipt of the request. This delay
may be extended by one month upon a reasoned decision by the chairman of the committee.
In case of emergency, this period is reduced to one month at the request of the Government.
when the commission is seized by the latter.
IV. - When it is not delivered at the end of the time limits set out in I and III, the notice
requested from the commission is deemed to be given.

Page 8

Article 10

In order to facilitate the lodging of complaints referred to in d of 2 ° of I of article
8 of the aforementioned law of 6 January 1978, the commission provides in particular a
complaint form that can be completed electronically.
The silence kept for three months by the commission on a complaint is valid
rejection decision.
Article 11

The accomplishment of the missions of the commission is free for the person
concerned and for the data protection officer.
However, when a request is manifestly unfounded or excessive in
due in particular to its repetitive nature, the committee may require the
payment of reasonable fees based on its administrative costs or refuse to
follow up on the request. In the event of a dispute, the burden of proof of
manifestly unfounded or excessive nature of the request lies with the
commission.
Article 12

When the committee requests, for the exercise of its missions, communication
documents that the controller or processor must have
in application of the aforementioned Regulation (EU) 2016/679 of April 27, 2016 or of Law 6
January 1978 referred to above, it may require the body concerned to attach a
French translation of documents written in another language.
Article 13

The salary lists established by the committee in application of 4 and 5 of
article 35 of regulation (EU) 2016/679 of 27 April 2016 referred to above and k of 2 ° of I
of article 8 of the aforementioned law of 6 January 1978 are published in the Official Journal
of the French Republic.
Article 14

Page 9

The National Commission for Informatics and Freedoms contributes to the activities
of the European Data Protection Board referred to in Article 68 of the
Regulation (EU) 2016/679 of April 27, 2016 referred to above.
Article 15

The Government Commissioner is summoned to all meetings
mentioned in article 17 of the law of January 6, 1978 referred to above in the same
conditions as members of the commission.
In the event of absence or impediment, he is replaced by a commissioner from
Deputy government.
The committee can validly deliberate only if the draft deliberation and, the
if applicable, the related report relating to the files on the agenda
of a session reached the Government Commissioner eight days
less before the date of the session.
The Government Commissioner may consult within the same timeframe, on site
and on documents, the files on the agenda.
Section 2: Control of the implementation of processing (Articles 16 to 37)
Sub-section 1: General provisions relating to authorization (Articles 16 to
22)
Paragraph 1: The authorization of the agents of the services of the commission and
the people helping him (Articles 16 to 19)
Article 16

The authorization provided for by the last paragraph of article 10 of the law of 6 January
1978 referred to above is issued to the agents of the services of the commission for
a renewable period of five years.
Article 17

No agent of the services of the commission can be authorized to carry out
a visit or verification if he has been convicted of a
correctional or criminal sentence entered in bulletin n ° 2 of the register

Page 10

judicial, or in an equivalent document in the case of a national
of the European Union.
Article 18

No agent of the services of the commission may be appointed to
carry out a visit or check with an organization within
of which:
1 ° He holds a direct or indirect interest, exercises functions or an activity
professional or has a mandate;
2 ° He has, during the three years preceding the visit or the verification,
held a direct or indirect interest, exercised functions or an activity
professional or held a warrant.
Article 19

When the conditions provided for in Articles 16 to 18 cease to be fulfilled,
the authorization is terminated after the person concerned has been placed in a position to
present their observations. In an emergency, the committee may
suspend the authorization for a maximum period of six months.
The authorization is also terminated when the interested party no longer exercises the
functions for which he was authorized.
Paragraph 2: Authorization of members and agents of other authorities
of control of the Member States of the European Union (Articles 20 to 22)
Article 20

The authorization provided for in III of article 25 of the aforementioned law of 6 January 1978
is issued to members and agents of state control authorities
members of the European Union for the duration of the joint operation which
takes place on French territory.
Article 21

Page 11

When the supervisory authority of a Member State requests the participation
from one of its members or agents to a joint operation, it certifies
to the President of the National Commission for Informatics and
freedoms that they meet the conditions provided for in Articles 17 and 18. The
chairperson of the committee is bound to refuse the authorization if the member or
the agent does not respect these conditions.
Article 22

The President of the National Commission for Informatics and Freedoms
may withdraw the authorization issued pursuant to Article 20 if the
conditions provided for in Articles 17 and 18 cease to be fulfilled. The interested
is called upon to present its observations. In case of emergency, the
president of the commission can suspend the authorization. He informs the authority
control concerned with the withdrawal or suspension.
Sub-section 2: Special provisions relating to the authorization of
agents, members of the commission and the people who lend it their
competition for processing covered by article 31 of the law of 6 January
1978 (Articles 23 to 24)
Article 23

Commission officials and persons assisting it,
called upon in the performance of their mission, to take cognizance of
information classified under the protection of defense secrets
national, must be authorized by the Prime Minister under the conditions
fixed by the defense code.
Commission officials and persons assisting it,
called upon to carry out visits or verifications relating to the treatments
falling under article 31 of the aforementioned law of 6 January 1978, must be
authorized by the Prime Minister, on the proposal of the President of the
commission, after an administrative inquiry, under the conditions provided for
by Article L. 114-1 of the Internal Security Code, verifying that the morality
or the behavior of these people is not incompatible with exercise
of their missions and consultation of these files.
Article 24

Page 12

The president of the National Commission for Informatics and Liberties
to know, each year, to the Prime Minister the names and positions of
members, officers of the commission and persons giving it their
competitions, appointed to carry out all investigations concerning
processing covered by article 31 of the aforementioned law of 6 January 1978.
Sub-section 3: On-the-spot checks (Articles 25 to 32)
Article 25

When the committee decides to carry out an on-the-spot check, it informs
beforehand in writing the public prosecutor in the territorial jurisdiction
from which the visit or verification is to take place.
The public prosecutor is informed no later than twenty-four hours
before the date on which the on-the-spot check is to take place. This notice specifies the
date, time, place and subject of the check.
Article 26

When the committee carries out an on-the-spot check, it informs at the latest
when he arrives on site, the person in charge of the premises or his representative
the purpose of the verifications it intends to undertake, of the identity and
quality of the persons in charge of the control as well as, where applicable, its
right of opposition to the visit. When the controller or the
subcontractor is not present on the site of the control, this information is
brought to its attention within fifteen days of the inspection.
As part of their verifications, the persons responsible for
present their mission order in response to any request and, if
if applicable, their authorization to carry out checks.
Article 27

When the chairman of the commission seizes the judge of freedoms and
detention on the basis of II of article 19 of the law of 6 January 1978
referred to above so that the latter authorizes the on-site visit, the judge decides in a
forty-eight hour time limit.

Page 13

Without prejudice to the third paragraph of II of this article 19, the ordinance
authorizing the on-site visit includes the address of the places to be visited, the name and
quality of the agent (s) authorized to carry out the inspection and
checks, where applicable, the name and position of the agent (s) or member (s) of the
supervisory authorities of the Member States empowered to carry out the same
operations, as well as the times they are allowed to report.
The ordinance, enforceable at the sight of the minute, is notified on the spot, at
at the time of the visit, to the person in charge of the premises or his representative who
receives full copy against receipt or signature in the minutes of
visit.
The act of notification includes an indication of the means and time limits for appealing against
the order authorizing the visit and against the conduct of operations
of verification. He also mentions that the judge who authorized the visit may
receive a request to suspend or stop this visit.
In the absence of the site manager or his representative, the ordinance
is notified, after the visit, by registered letter with request for notice of
reception. In the absence of receipt of the registered letter, the
service of the order by judicial officer.
The liberty and detention judge may, if he considers it useful, go to
the premises during the intervention. At any time, he can decide to suspend
or stop the visit. Referral to the liberty and detention judge for the purposes of
suspension or stopping of inspection and verification operations has not
suspensive effect.
Article 28

Modified by Decree n ° 2019-966 of September 18, 2019 - art. 8

The order authorizing the visit can be appealed to the first
President of the Court of Appeal according to the rules provided for in Articles 931 and
following of the Code of Civil Procedure.
This appeal is made by declaration delivered or sent by letter
registered with request for acknowledgment of receipt at the registry of the court of appeal
within fifteen days of notification of the order. This
appeal is not suspensive.
The registry of the judicial court immediately transmits the case file to the
registry of the court of appeal where the parties can consult it.

Page 14

The order of the first president of the court of appeal is liable to
cassation appeal according to the rules provided for in articles 974 et seq.
of the Code of Civil Procedure.
NOTE:
In accordance with article 9 of decree n ° 2019-966 of September 18, 2019, these
provisions come into force on January 1, 2020.

Article 29

The first president of the court of appeal hears appeals against the
conduct of visit operations authorized by the judge of freedoms and
detention.
The appeal is filed by declaration delivered or sent by letter
registered with request for acknowledgment of receipt at the registry of the court of appeal
within fifteen days of the notification of the report of
visit. This appeal is not suspensive.
The order of the first president of the court of appeal is liable to
cassation appeal according to the rules provided for in articles 974 et seq.
of the Code of Civil Procedure. The time limit for an appeal in cassation is fifteen
days.
Article 30

When, in application of articles 24 to 28 of the aforementioned law of 6 January 1978
the commission carries out verifications, at the request of a
control of another Member State of the European Union, it shall inform the
controller or processor.
The committee also informs the controller or the
processor that the information collected or held by it is
likely to be communicated to other supervisory authorities in the
framework of the consistency control mechanism provided for in section 2 of the
Chapter VII of Regulation (EU) 2016/679 of April 27, 2016 referred to above, that the
control has been carried out at the request of another authority or at its sole
initiative.
Article 31

Page 15

The on-site control missions are the subject of a report.
The report states the nature, day, time and place of the checks or
of the checks carried out. It also indicates the purpose of the mission, the
members of the latter present, the people met, if applicable,
their statements, requests made by members of the mission
as well as any difficulties encountered. Parts inventory and
documents of which the persons in charge of the control have taken a copy is annexed
in the minutes.
When the visit could not take place, the report mentions the reasons for
have prevented or hindered its progress, as well as, where applicable, the reasons
opposition from the site manager or his representative.
The report is signed by the persons in charge of the control who have
process and by the site manager or his representative. In case of
refusal or lack of signature, mention is made in the minutes.
The report is notified to the person in charge of the premises and to the person in charge of
processing and, where applicable, to its subcontractor by registered letter with
request for acknowledgment of receipt. When only the subcontractor has been subject to
on-site inspection, the report is notified to him, as well as, where applicable, to the
controller and the persons mentioned in the previous paragraph,
under the same terms.
Article 32

When the visit takes place with the authorization and under the supervision of the judge in
application of II of article 19 of the aforementioned law of 6 January 1978, copy of
The report of the visit is sent to him by the chairman of the committee.
Sub-section 4: Online control (Article 33)
Article 33

When members or agents use an assumed identity within the meaning
of III of article 19 of the aforementioned law of 6 January 1978, to control
online public communication services of a controller
or a subcontractor, they draw up a report of the online operations
carried out, the terms of consultation and use of these services,
responses obtained and their findings. The relevant pages of the site or
any other information with regard to the findings made are there

Page 16

annexed. This report is sent to the controller or to the
subcontractor.
Sub-section 5: Hearing on summons (Article 34)
Article 34

In application of the first paragraph of III of article 19 of the law of January 6, 1978
aforementioned, the agents authorized in application of Articles 10 and 25 of this
same law can hear any person likely to provide them with everything
information or any justification useful for the accomplishment of their
mission.
The agents authorized in application of the aforementioned article 10 send the
convocation, by letter delivered against signature, or hand delivery
against receipt or act of bailiff, which must reach at least eight days before
the date of his hearing.
The summons reminds the person summoned that they are entitled to
to be assisted by a counsel of his choice.
A report is drawn up under the conditions provided for in Article 31. When
the person concerned does not attend the hearing, this is mentioned in a
deficiency report drawn up by the persons in charge of the control.
Sub-section 6: Recourse to experts (Articles 35 to 36)
Article 35

When, in application of III of article 19 of the law of 6 January 1978 referred to above,
president of the commission calls on one or more experts, his request
defines the subject of the expertise and sets the deadline for its completion.
Prior to appraisal operations, the designated appraiser (s) certify
to the chairman of the committee that they meet the conditions set
in Articles 16 to 19.
Compensation due to experts is, where applicable, the subject of an agreement.
The expert (s) inform the chairman of the committee of the progress of
appraisal operations. These are carried out contradictorily.

Page 17

The expert report is submitted to the chairman of the commission who sends it
a copy to the controller or processor.
Article 36

When verification operations require access to data
individual medical, in the cases provided for in III of article 19 of the law of 6
January 1978 referred to above, the prefect or, as the case may be, the director general of
the regional health agency in whose jurisdiction the
control appoints, at the request of the chairman of the committee, a doctor
labor inspector or a doctor responsible for requesting the communication of
those data ; the chairman of the committee may also appoint a
doctor registered on a list of forensic experts. The president of the
commission defines the conditions for carrying out the mission entrusted to the doctor
according to the forms prescribed in the first and second paragraphs of article 35.
Prior to the required verification operations, the designated doctor
certifies to the chairman of the committee that he meets the conditions
posed in Articles 16 to 19.
The doctor presents his mission order in response to any request.
The doctor writes down in a report the checks he made without doing
state, in any way, of the individual medical data to which he has
had access.
The report is submitted to the chairman of the committee who sends a copy
to the controller or the processor.
Sub-section 7: Professional secrecy (Article 37)
Article 37

When a person interviewed as part of the checks carried out by the
commission opposes one of the professional secrets mentioned in III of
article 19 of the aforementioned law of 6 January 1978, mention of this opposition is
entered in the report drawn up by the persons responsible for the control. It is
then also mentions the legislative or regulatory provisions
to which refers, where applicable, the interviewee as well as the
nature of the data it considers covered by these provisions.
Section 3: Corrective measures, sanctions and penalties (Articles 38 to 47)

Page 18

Sub-section 1: The ordinary procedure (Articles 38 to 45)
Article 38

The formal notice specifies the breach (s) of the obligations
incumbent on the controller or processor under the
Regulation (EU) 2016/679 of April 27, 2016 referred to above or the law of January 6
1978 referred to above which were noted by the commission.
The formal notice, decided by the chairman of the committee, sets the deadline
at the end of which the controller or processor is required
to have put an end to the breach (s) observed. This period cannot, except
emergency, be less than ten days. It cannot exceed six months. He runs to
from the day of receipt by the controller of the implementation
remains. When the complexity of the case justifies it, this delay may be
renewed once within the same limit.
The formal notice is sent to the controller or to the
subcontractor by any means allowing the commission to provide proof
from the date of this notification. It is also transmitted, as
information, to the Government Commissioner.
Article 39

When a sanction is likely to be pronounced, the president of the
committee appoints a rapporteur who does not belong to the restricted group
and informs the data controller or the subcontractor involved.
The rapporteur carries out all necessary diligence with the assistance of the services
of the commission. The controller or processor may be
heard if the rapporteur considers it useful. The hearing of the controller
or the subcontractor gives rise to the establishment of a report which he signs.
In the event of refusal to sign, this is mentioned by the rapporteur. The
persons heard may be assisted by counsel of their choice. The
rapporteur may hear any other person whose hearing seems useful to him.
Article 40

The report provided for by article 22 of the aforementioned law of 6 January 1978 is notified
the controller or the processor by any means allowing

Page 19

the commission to provide proof of the date of this notification. It is
also transmitted to the restricted formation.
The controller or the processor has a period of one month
to transmit its observations to the rapporteur and to the restricted group
written. The notification of the report mentions this deadline and specifies that the
controller can take cognizance and copy of the documents of the
file with the services of the commission and be assisted or
represent by any counsel of his choice.
The rapporteur can respond to the controller or the processor
within fifteen days of receipt of the respondent's observations.
The controller or processor has a new period of
fifteen days to, if necessary, produce written observations. The
restricted training is the recipient of letters and documents exchanged in
application of this paragraph.
When the circumstances of the case or the complexity of the case justify it,
the president of the restricted formation may decide, at the request of the rapporteur
or the organization in question, to extend, within a limit of one month, the
deadlines mentioned in the second and third paragraphs. When an extension
the time limit is granted by the chairman of the restricted group to the rapporteur,
it is systematically granted to the controller or to the
subcontractor, who is informed thereof.
The controller or processor is informed that the
deadlines mentioned in the second, third and fourth paragraphs, except postponement
of the closure of the investigation, the investigation is closed and its written observations
will be declared inadmissible by the restricted committee.
At any time, the rapporteur can decide to modify his report, in particular,
in the light of elements brought to its attention by the controller
or the subcontractor. The procedure provided for in the
previous paragraphs. If the modification occurs after the closing of the instruction,
the investigation is reopened.
Article 41

The controller or processor is informed of the date of the
session of the restricted panel during which the case is entered on
concerning and the faculty offered to him to be heard there, himself or his
representative, by any means allowing the date of its notification to be certified.
This information must reach him at least one month before the date of the session.
during which the case is considered. In case of review or postponement

Page 20

of the case at a subsequent session, this minimum period may be reduced to
seven days.
Article 42

During the meeting, the rapporteur may make oral observations on
the case. When attending the session, the controller or
subcontractor and, where applicable, its counsel are invited to present
oral observations in support of their written submissions. The commissioner of
Government is invited to give its opinion on the case. Restricted training
can hear anyone whose hearing it considers useful. In all the
case, the controller or the processor and, where applicable, his
council should be able to speak last. When training
limited considers itself insufficiently informed, it may ask the rapporteur
to continue his due diligence.
An agent of the services of the commission, acting as secretary of
meeting, may be appointed by the president of the restricted formation. He assists
the deliberations of the restricted formation, without taking part in it. It falls under the sole
authority of the president of the restricted formation within the framework of these functions.
Article 43

The sanction decision sets out the legal and factual considerations on
which it is based. It indicates the means and time limits for appeal.
The sanction decision is notified to the person concerned by any means
used to certify the date of its notification. This decision is
communicated to the chairman of the committee.
When the restricted committee decides to publish the sanction decision, this
publication may take place as soon as the sanction decision is notified to the
concerned person. The decision thus published indicates that an appeal is
likely to be brought against him before the administrative judge.
Article 44

When the restricted committee decides to add a penalty to its decision
injunction of compliance, in application of 2 ° of III of article 20 or

Page 21

of 6 ° of I of article 21 of the aforementioned law of 6 January 1978, it may do so
by the same decision.
The data controller or the subcontractor transmits to the training
restricted, no later than the date set in the latter's decision, the
evidence that he complied with the injunction issued against him.
In the event of total or partial non-performance or late performance, the training
Restricted proceeds to the liquidation of the fine it had pronounced. The
the amount of the penalty payment is settled taking into account the elements transmitted, the
where applicable, by the data controller or the processor, its
behavior and execution difficulties that he encountered, especially if he
is established that the non-performance or delay in performance is due, in whole or in
party, from a cause unrelated to compliance capabilities.
The decision pronouncing the liquidation of the penalty payment is preceded by a
written procedure during which the restricted formation leads to the
knowledge of the controller or processor of the reasons for the
envisaged liquidation and its amount.
The controller or the processor has a period of fifteen
days from the date of notification of the reasons for the liquidation and its
amount to send to the restricted panel its written observations. This
deadline is mentioned during the notification. This takes place by any means.
The rapporteur appointed in the context of the procedure leading to the
pronouncement of the injunction is kept informed in writing of the initiative of the formation
restraint.
When the president of the restricted formation considers that the elements
explanation provided by the controller or processor
require additional checks, he can ask the rapporteur
to intervene again, under the conditions provided for in Article 39.
Article 45

The provisions of this section are applicable when the
cause a certification body or body responsible for compliance with a
code of conduct in application of article 23 of the law of January 6, 1978
above.
Sub-section 2: The urgent procedure (Articles 46 to 47)
Article 46

Page 22

Subject to the following provisions, Articles 39 to 43 of this
decree, with the exception of the third to fifth paragraphs of article 40, are
applicable to the procedure governing the sanctions taken in application of 1 °
at 7 ° of I of article 21 of the aforementioned law of 6 January 1978.
The controller or processor has a period of eight
days to send the restricted formation its written observations.
The convocation of the controller or the processor must be
arrived at the latest eight days before the date of her hearing before the
limited training.
Article 47

When the limited training finds that the implementation of a treatment
data, among those that concern state security or
defense or those falling under Title III of the aforementioned law of 6 January 1978,
entails a violation of the rights and freedoms mentioned in article 1 of the
same law, it informs, by any means, the controller or the
subcontractor.
The controller or processor has a period of eight
days to send the restricted formation its written observations on the
shortcomings that have been observed. This deadline is brought to its attention.
The president of the restricted formation informs, if necessary, the First
Minister of the violation found.
Section 4: Cooperation (Articles 48 to 60)
Article 48

Articles 38 to 44 are applicable to this section.
Subsection 2 applies when the National Commission for Informatics and
of freedoms intends to adopt a measure as the lead authority within the meaning of
Article 56 of Regulation (EU) 2016/679 of April 27, 2016 referred to above for
processing operations falling within the scope of this regulation.
Sub-section 1: Common provisions (Articles 49 to 50)

Page 23

Article 49

Subject to implementing acts adopted by the European Commission
in application of article 67 of regulation (EU) 2016/679 of April 27, 2016
aforementioned, communications between the National Commission for Informatics
and freedoms and other supervisory authorities or between the Commission
National Information Technology and Civil Liberties Committee and the European Committee for
data protection is done by any electronic means allowing
to certify the date of receipt.
If this communication proves to be long or difficult due to the nature or
volume of information exchanged, the commission transmits this information
by any means or make them available to other supervisory authorities or to the
European Data Protection Board.
Article 50

When it notifies its final decision to the controller or to the
subcontractor, the committee attaches to it, where applicable, the committee's decision
European Data Protection Officer.
Sub-section 2: The National Commission for Informatics and Civil Liberties
as lead supervisory authority (Articles 51 to 56)
Article 51

The chairman of the committee submits without delay to the supervisory authorities
concerned the draft warning provided for in I of article 20 of the law of 6
January 1978 referred to above or the draft formal notice provided for in II of this
same article.
Article 52

If the objections of the supervisory authorities concerned tend to be
pronounced a measure provided for under III of article 20 of the law of 6 January
1978 referred to above instead of the measure initially proposed in
application of II of article 20 of the same law, the chairman of the commission,
if it decides to follow these objections, appoints without delay a rapporteur who

Page 24

hears the case taking into account these objections under the conditions
provided for in Article 40. The restricted panel adopts a final decision in
the conditions provided for in Article 56.
If the chairman of the committee does not intend to follow these objections, he addresses
the data controller or the processor, before referring the matter to the committee
European Data Protection Act pursuant to Article 65 of the
Regulation (EU) 2016/679 of April 27, 2016 referred to above, all the information
useful information on the draft decision he had prepared as well as the objections
formulated by the supervisory authorities concerned. The person in charge of
treatment or the subcontractor has a period of fifteen days, renewable
once, to provide feedback, which is forwarded to the committee
at the time of its referral.
If the binding decision of the committee involves adoption by the committee
a measure falling under II of Article 20, the chairman of the committee
pronounces the formal notice. If the binding decision of the committee involves
the adoption by the commission of a measure provided for in III of Article 20,
president of the committee seizes the restricted formation under the conditions
provided for in Article 39.
Article 53

The restricted group communicates to the supervisory authorities concerned the
report and useful information mentioned in the first paragraph of article 27
of the aforementioned law of 6 January 1978, at the latest one week after the
notification provided for in the first paragraph of Article 40.
The supervisory authorities concerned are informed of the date of the session
of the restricted training provided for in article 41 at the same time as the
controller or processor and receive any information
useful, in particular the observations in defense of the respondent. They are
enabled to attend the hearing through videoconferencing tools
or electronic communication allowing them to be identified or taken
knowledge by means of recording. Failing that, a report
is drawn up at its end, of which they can take cognizance.
Article 54

The restricted group submits the draft decision to the others without delay
supervisory authorities.

Page 25

Article 55

If the objections of the supervisory authorities concerned propose to deviate
of the draft decision mentioned in Article 54 by taking into account a
new factual circumstance, the addition of a breach or an aggravation of
the nature of the corrective measure initially proposed, the limited training
reopen the investigation and communicate these objections to the rapporteur without delay
so that he completes his report and, if necessary, modifies it. The manager
processing or the subcontractor has a period of fifteen days,
renewable once by decision of the president of the restricted formation, for
share their observations. The restricted formation then deliberates on the
consideration of objections.
If the restricted panel decides to reject the authorities' objections, it
refers the matter to the European Data Protection Board in application of
article 65 of the aforementioned regulation (EU) 2016/679 of April 27, 2016.
Article 56

At the end of the procedures provided for in Articles 60 and 65 of Regulation (EU)
2016/679 of April 27, 2016 referred to above, the restricted committee takes its decision
final. This decision mentions, where applicable, the exchanges between
supervisory authorities or with the European Committee for the Protection of
data.
Sub-section 3: The National Commission for Informatics and Civil Liberties
as the relevant supervisory authority (Article 57)
Article 57

Upon receipt of a draft corrective measure equivalent to those
defined in III of article 20 of the aforementioned law of 6 January, issued by a
lead supervisory authority, the chairman of the restricted group, referred
by the chairman of the committee, may either convene the latter in order to
to issue, if necessary, relevant and reasoned objections, or to deal with the
case or entrust it to a member of the restricted formation designated by him.
Sub-section 4: Procedure in exceptional circumstances (Articles
58 to 60)

Page 26

Article 58

The third to fifth paragraphs of article 40 do not apply to the
procedure governing the measures taken under II of article 21 of the law of
January 6, 1978 referred to above.
By way of derogation from the second paragraph of Article 40, the controller
or the subcontractor has eight days to transmit to the
training limited its written observations.
By way of derogation from Article 41, the convocation of the controller or the
subcontractor must be received at the latest eight days before the date of his
hearing before the restricted formation.
By way of derogation from Article 55, the time limit available to the controller
or the subcontractor to transmit its observations to the restricted group
written is fixed at eight days.
Article 59

The restricted committee communicates the provisional measure adopted as well as its
period of validity, which may not exceed three months in accordance with 1 of article
66 of the aforementioned Regulation (EU) 2016/679 of April 27, 2016, to the
control, the European Data Protection Board and the
European Commission. It notifies the controller or the
subcontractor by any means allowing the commission to certify the date of
notification.
This decision is communicated to the president of the commission and to the
protractor.
Article 60

The president of the restricted formation brings together the latter so that it can deliberate
in view of a report on the need for definitive action. The
restricted training may, with reasons, refer to the European Committee for
data protection of an opinion or decision request.
Chapter II: Formalities prior to the implementation of processing operations (Articles 61 to
70)

Page 27

Section 1: General provisions (Articles 61 to 65)
Article 61

In order to facilitate the completion of the formalities prior to the
implementation of the processing of personal data, the commission defines
models of declaration, request for opinion, consultation and request
authorization and establishes the list of annexes which, if applicable, must be attached.
Article 62

Declarations, requests for opinions, consultations and requests for authorization are
presented by the controller or by the person having quality
to represent it. When the controller is a person
natural person or a service, the legal person or the public authority to which he reports
must be mentioned.
Statements, consultations and requests are addressed to the committee by
electronically.
The decision by which the president renews or extends the time limits
has the commission to notify its opinions and authorizations is notified to the
data controller by letter delivered against signature or by
electronic under the conditions set out in the second paragraph of Article L. 112-15
of the code of relations between the public and the administration.
Article 63

When a request for advice, authorization or consultation is presented for
the account of the State, of a legal person governed by public law or of a person
private law morality managing a public service or that it is the subject of an examination in
plenary session of the committee or in the bureau, a copy of the request is
transmitted prior to any deliberation to the Government Commissioner.
The latter may, at his request, have a copy of any declaration, request
notice, request for authorization or any consultation.
The communications provided for in the first two paragraphs can be made,
where appropriate, electronically.
Article 64

Page 28

When a declaration, a request for an opinion, a request for authorization or a
consultation is examined in plenary or in the bureau, on
Government Commissioner presents his observations.
The controller or any person whose hearing is requested by
the Commission or the Government Commissioner can be heard.
Article 65

For the application of article 33 of the law of January 6, 1978 referred to above by the
controller, the committee is informed without delay within
conditions provided for in article 62 of this decree.
Section 2: Requests for advice and authorization (Articles 66 to 70)
Article 66

The deliberation giving notice, authorization or refusal of authorization of the commission
is notified by letter delivered against signature or electronically within the
conditions set in the second paragraph of article L. 112-15 of the relations code
between the public and the administration, within eight days, to the person in charge of
processing that made the request.
It is sent to the Government Commissioner.
Article 67

I. - The file produced in support of a request for an opinion submitted in application
of articles 31 or 32 of the aforementioned law of 6 January 1978 includes, in addition to
mentions provided for in article 33 of the same law, annexed to the draft act
authorizing the processing, mentioned in article 35 of the same law.
II. - Requests for opinions relating to the processing operations the list of which is fixed in
application of the last paragraph of I of article 33 of the law of 6 January 1978
referred to above include, at a minimum, the following information:
1 ° The identity and address of the controller;
2 ° The purpose or purposes of the processing, if applicable, the name of the processing;

Page 29

3 ° The service (s) responsible for carrying out the processing;
4 ° The service to which the right of access provided for in Articles 49, 105 and
119 of the aforementioned law of 6 January 1978 as well as the measures taken to facilitate
the exercise of this right;
5 ° The categories of persons who, by reason of their functions or for
service needs, have direct access to recorded data;
6 ° The recipients or categories of recipients authorized to receive
data communication;
7 ° Where applicable, interconnections, mergers or any other form
of connection with other treatments.
Article 68

The commitment to comply with a single regulatory act taken in application
of IV of article 31 of the aforementioned law of 6 January 1978 is addressed to the
commission under the conditions provided for in article 62 of this decree.
Article 69

The reasoned opinions of the committee issued in application of Articles 31 and 32 of the
Law of 6 January 1978 referred to above and the acts to which they relate are published in the
same date by the controller.
Article 70

When a treatment is the subject of a decree authorizing the exemption from publication
of the act authorizing it in application of III of article 31 of the law of January 6, 1978
abovementioned, the meaning of the opinion issued by the committee can only bear the mention
"Favorable", "favorable with qualification" or "unfavorable".
In the cases referred to in the first paragraph and for the application of II of Article 36 of the
Law of 6 January 1978 referred to above, the commission cannot make available to the
audience as the meaning of his opinion.

Page 30

Title II: TREATMENTS UNDER THE PROTECTION SCHEME
PERSONAL DATA PROVIDED FOR BY THE REGULATIONS
(EU) 2016/679 OF APRIL 27, 2016 (Articles 71 to 128)
Article 71

This title applies to processing covered by title II of the law of January 6, 1978.
above.
Chapter I: General provisions (Articles 72 to 76)
Section 1: Codes of conduct, binding company rules,
certifications (Articles 72 to 75)
Article 72

Pursuant to Article 40 of Regulation (EU) 2016/679 of April 27, 2016
aforementioned, associations and other bodies representing categories of
data controllers or processors submit a draft code of
conduct, modification or extension of an existing code at the Commission
national data processing and freedoms.
The committee approves this draft code, this modification or this
extension within four months of receipt of the
request. This period may be extended by two additional months upon decision.
of its president. When the committee has not taken a decision within these time limits,
the request is deemed to be rejected.
If the committee requests, in application of 7 of Article 40 of Regulation (EU)
2016/679 of April 27, 2016 referred to above, the European Committee for the Protection of
data mentioned in article 68 of the same regulation, the deadlines provided for in
second paragraph are suspended until notification of the opinion delivered by this
committee or, where appropriate, the decision taken by the European Commission, in
application of the rules relating to the consistency control mechanism. The
commission informs the applicant of this referral and the consequences thereof.
Article 73

When the National Commission for Informatics and Freedoms is seized of a
request for approval of binding company rules mentioned in

Page 31

Article 47 of Regulation (EU) 2016/679 of April 27, 2016 referred to above, it
communicates a draft decision to the European Committee for the Protection of
data referred to in Article 68 of the same Regulation within six months.
This period may be extended by two additional months by decision of its
President. The commission informs the requester of this transmission.
After receiving the opinion of the European Data Protection Board in
under Article 64 of Regulation (EU) 2016/679 of 27 April 2016 referred to above or,
if applicable, after the implementation of the dispute resolution procedure by
the committee in application of article 65 of the same regulations, the committee
pronounces on the request within one month. When the commission does
has not taken a decision within this time limit, the application is deemed to be rejected.
Article 74

I. - When it plans to develop or approve the criteria for
certification and approval reference systems mentioned in h of 2 ° of I of article 8
of the aforementioned law of 6 January 1978, the National Commission for Informatics and
of freedoms is pronounced, depending in particular on the field of activity and
the subject of the certification reference system, the certification procedures and
approval selected from among those defined in this article.
The commission may decide to issue the certifications itself or to issue them.
leave it to third parties.
When certification is issued by third-party organizations, the commission
determines, depending on the field of activity and the subject of the
certification, if it directly approves these certification bodies or if this
approval may be issued by the national accreditation body mentioned in
b of 1 of article 43 of the aforementioned regulation (EU) 2016/679 of 27 April 2016. In
in the latter case, the commission refers to the national accreditation body which
carries out a feasibility study for the accreditation of certification bodies
potentially affected. A convention sets out the terms of cooperation
between the commission and the national accreditation body.
II. - The content of the certification and approval request file
presented to the committee within the framework of I is fixed by the deliberation deciding
the certification or accreditation criteria.
The committee takes a decision within four months of the
receipt of a complete application. This period can be extended by two months
additional by decision of its chairman. When the commission did not
not delivered within these time limits, the request is deemed to be rejected.

Page 32

If the committee requests, in application of 3 of Article 43 of Regulation (EU)
2016/679 of April 27, 2016 referred to above, the European Committee for the Protection of
data mentioned in article 68 of the same regulation, the deadlines provided for in
second paragraph are suspended until notification of its opinion or, where
appropriate, of its decision in accordance with 6 of article 65 of the aforementioned regulation.
The commission informs the applicant of this referral and of the consequences thereof.
The content of the application files presented to the national body
accreditation under I, and the conditions for their processing, including
the additional requirements set, if any, by the commission, are
defined by the accreditation regulations of the national accreditation body.
This accreditation takes the place of accreditation.
III. - Certifications are issued for a period specified by each
certification reference system and which cannot be longer than three years.
Certification bodies are approved for a maximum period of five years
renewable under conditions set by the internal regulations of the
commission or, as the case may be, by the accreditation regulation of the body
national accreditation.
Article 75

If the committee refers to the European Data Protection Board
mentioned in Article 68 of Regulation (EU) 2016/679 of April 27, 2016 referred to above in
outside the time limits provided for in Articles 72 to 74 of this decree, it issues a
decision no later than one month after notification of the committee's decision.
Section 2: Provisions relating to the processing of personal data
personnel relating to criminal convictions, offenses or measures
related security measures (Article 76)
Article 76

In application of 1 ° of article 46 of the aforementioned law of 6 January 1978, are
authorized to carry out the processing of personal data
relating to criminal convictions, offenses or security measures
related:
1 ° a) Until the entry into force of II and VII of article 42 of the law of 23 March
2019 referred to above under the conditions specified in XI of its article 109, the
victim support associations approved by the Ministry of Justice;

Page 33

b) After the entry into force of II and VII of article 42 of the law of 23 March 2019
referred to above under the conditions specified in XI of its article 109, the associations
assistance to victims approved by the Ministry of Justice;
2 ° The associations helping the reintegration of people placed under the control of
justice mentioned in article 2-1 of law n ° 2009-1436 of 24 November 2009
prison, while respecting their social purpose;
3 ° The establishments and services mentioned in 2 ° of I of article L. 312-1 of
code of social action and families as part of their support mission
medico-social;
4 ° The establishments and services mentioned in 4 ° and 14 ° of I of article L.
312-1 of the code of social action and families;
5 ° The living and reception areas mentioned in III of Article L. 312-1 of the Code of
social action and families;
6 ° The authorized medical or medico-educational establishments mentioned
Articles 15 and 16 of Ordinance No.45-174 of February 2, 1945 relating to
delinquent childhood;
7 ° Public or private institutions or establishments, of education or
vocational training, qualified and appropriate boarding schools for minors
school-aged delinquents mentioned in articles 15 and 16 of the ordinance of 2
February 1945 referred to above;
8 ° Legal entities governed by private law exercising a public service mission
or the authorized associations mentioned in article 16 ter of the ordinance of 2
February 1945 referred to above;
9 ° The legal representatives for the protection of adults mentioned in article
L. 471-1 of the code of social action and families.
Chapter II: Rights of the data subject (Articles 77 to 81)
Section 1: General provisions (Articles 77 to 80)
Article 77

When the data subject makes a request, including by way of
electronic, tending to the implementation of the rights provided for in Articles 48, 49,
50, 51, 53, 54, 55 and 56 of the aforementioned law of 6 January 1978, it justifies its
identity by any means. She can exercise her rights by using data

Page 34

digital identity when this data is needed and estimated
sufficient by the controller to authenticate its users.
When the controller or processor has doubts
reasonable as to the identity of this person, he may request the
additional information that appears necessary, including, when the
situation so requires, a photocopy of an identity document bearing the holder's signature.
The deadlines provided for in Article 12 3 of Regulation (EU) 2016/679 of April 27
2016 aforementioned are suspended when the controller or the
subcontractor requested additional information necessary to
identify the person concerned.
When there is reasonable doubt as to the identity of the applicant or the address
postal mail to which the data subject has requested transmission in writing
information about it, the response can be sent by registered mail
without acknowledgment of receipt, the address and identity being verified during
of the delivery of the envelope.
When the controller, processor or data controller
data protection is not known to the applicant, the latter can send his
request to the head office or to the functional e-mail address of the person
legal entity, public authority, service or body whose processing
relieves. The request is sent immediately to the controller.
The request may also be presented by a person specially
mandated for this purpose by the applicant, if this proves his identity and
the identity of the principal, his mandate as well as the duration and the precise object of
this one. The mandate must also specify whether the proxy can be returned
recipient of the response from the controller or processor.
Article 78

When a request is made on the spot, the person concerned justifies by
any means of his identity with the controller or the
subcontractor. The request may be presented by a person specially
authorized for this purpose by the applicant, under the conditions provided for in Article 77.
When the request cannot be satisfied immediately, it is issued to its
author an acknowledgment of receipt, dated and signed.
Article 79

Page 35

Without prejudice to 4 of article 12 of regulation (EU) 2016/679 of April 27, 2016
above, if the request sent by the data subject is imprecise or does not
does not include the elements allowing the controller or the
subcontractor to respond to it, the latter may invite the applicant to provide it with
additional information within the time limits provided for in 3 of article 12 of the same
regulation.
When the controller or the processor has not commented
within the deadlines mentioned in 3 and 4 of article 12 of regulation (EU) 2016/679
of April 27, 2016 referred to above, the application is deemed to be rejected.
Article 80

The codes, acronyms and abbreviations appearing in the documents issued by the
controller, processor or data protection officer
data in response to a request must be clarified, if necessary under the
form of a lexicon or standardized icons.
Section 2: Provisions specific to rights exercised indirectly
(Article 81)
Article 81

The provisions of articles 141 to 143 are applicable to the processing operations
work by public administrations and private individuals responsible for
public service mission whose mission is to control or collect
taxes as well as those concerning public security, if the act establishing the
treatment provided that the rights of access, rectification and erasure
would be exercised under the conditions of article 52 of the law of January 6, 1978
above. The acts creating this processing contain the provisions
mentioned in the second paragraph of Article 23 of Regulation (EU) 2016/679
of April 27, 2016 referred to above.
Chapter III: Obligations incumbent on the controller and the
subcontractor (Articles 82 to 116)
Section 1: General obligations (Articles 82 to 85)
Article 82

Page 36

A data protection officer is appointed by the person responsible for
processing or by the processor in the cases provided for in Article 37 of the Regulation
(EU) 2016/679 of April 27, 2016 referred to above.
The delegate ensures compliance with the obligations provided for in Regulation (EU)
2016/679 of April 27, 2016 referred to above and by the aforementioned law of January 6, 1978.
Article 83

Communication to the National Commission for Informatics and Civil Liberties
contact details provided for in 7 of Article 37 of Regulation (EU) 2016/679 of 27 April
2016 referred to above includes the following mentions:
1 ° The surname, first name and professional contact details of the
processing or subcontractor or, where applicable, those of its representative, as well
than those of the data protection officer. For legal persons
data controllers and processors, their name, their headquarters
social as well as the body that represents them legally;
2 ° When the data protection officer is a legal person, the
same information concerning the agent designated by the legal person
to perform delegate duties.
The contact details mentioned in 1 ° and 2 ° are communicated without delay to the
National Commission for Informatics and Freedoms by electronic means as well
as any modifications thereof.
The name and professional contact details of the organization as well as the
means of contacting the data protection officer are the subject of a
dissemination in an open format that can be easily reused by the Commission
national data processing and freedoms.
Article 84

In accordance with article 37 of regulation (EU) 2016/679 of April 27, 2016
aforementioned, data controllers or processors may appoint a
the only data protection officer who performs his duties on behalf of
of several of them.
When local authorities, their groups, establishments
local public authorities, and legal persons governed by private law managing a public service
appoint a single data protection officer, an agreement determines

Page 37

the conditions under which the pooling is carried out. Each of the parties to the
mutualisation remains responsible for the processing or subcontractor.
Article 85

Are authorized to derogate from the right to communicate a data breach,
under the conditions provided for in II of article 58 of the law of 6 January 1978
aforementioned:
1 ° Processing comprising personal data that may be
to allow, directly or indirectly, to identify persons whose
anonymity is protected under article 39 sexies of the law of 29 July 1881 on
freedom of press ;
2 ° The processing of administrative, financial and management data
operational as well as the processing of health data for which the
notification of unauthorized disclosure or access is likely to
represent a risk to national security, national defense or
public security with regard to the volume of data affected by the breach and
information relating to the private life that they contain such as the address
or the composition of the family.
Section 2: Processing of personal data in the field of
health (Articles 86 to 115)
Sub-section 1: General provisions (Articles 86 to 87)
Article 86

The processing of personal data in the field of
health mentioned in the first paragraph of article 67 of the law of January 6, 1978
above, the sole purpose of which is to respond, in the event of an emergency,
to a health alert and manage the consequences can use the number
registration in the national directory for the identification of natural persons
under the conditions provided for in the second paragraph of the same article 67 when a
such use is the only way to collect health data from
personal character necessary to deal with the health emergency.
The registration number in the national directory for the identification of persons
physical data is collected either directly from the persons concerned, or
indirectly from their relatives or all legal persons
authorized to process this number as part of their missions or activities.

Page 38

Its transmission and storage on electronic or digital media make
subject to encryption, in accordance with recommendations, standards or
model regulations adopted by the National Commission for Informatics and
freedoms. It is kept for the time necessary for data matching.
Article 87

Subject to the specific provisions of this chapter, requests
authorization formulated in application of section 3 of chapter III of title II
of the aforementioned law of 6 January 1978 are instructed under the conditions provided for
in Chapter II of Title I of this decree.
Sub-section 2: Special provisions relating to processing at
for research, study or evaluation in the field of health
(Articles 88 to 107)
Paragraph 1: Presentation and examination of authorization requests
of salaries (Articles 88 to 92)
Article 88

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
In the cases provided for in article 76 of the aforementioned law of 6 January 1978, the
data processing authorization request files
staff whose purpose is research, studies and evaluations in the
health sector are signed by the person who is qualified to
represent the data controller.

They are filed either with the National Commission for Informatics
and freedoms, after consulting the competent committee for the protection of
persons in application of 1 ° of article 76 of the law of January 6, 1978
aforementioned, or with the single secretariat entrusted, in accordance with 2 ° of
Article L. 1462-1 of the Public Health Code, to the Platform for
health data.

The files deposited with the single secretariat are transmitted in a
maximum period of seven working days for the ethics and scientific committee to
health research, studies and evaluations
to give an opinion on the project.

Page 39

Article 89

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
Each file submitted to the single secretariat mentioned in article
88 must include:

1 ° The identity, address, titles, experiences, functions and declarations
of interest in connection with the subject of the research of the controller and
the research, study or evaluation manager, as well as the
where applicable, the identity and address of the research commissioner,
the study or evaluation and the public person who made it
request. If these managers or sponsors are not established on the
national territory, nor on that of another Member State of the Union
European Union, the identity, address and functions of their
representative within the European Union.

The missions or corporate purpose of the organization concerned are also
specified;

2 ° The categories of people who will be called upon to implement the
processing as well as those who will have access to the data;

3 ° The methodology of the study or the evaluation or the
research, indicating in particular the purpose of the data processing to
personal character, the categories of persons concerned by the
processing, origin, nature and list of personal data
used and the justification for their use, the duration and methods
organization of the research, study or evaluation, the method
data analysis, as well as, when the characteristics of the study,
research or evaluation so requires, the justification for the number of
persons and the method of observation or investigation adopted;

4 ° The type of dissemination or publication of the results of the study,
research or assessment by the applicant;

Page 40

5 ° If necessary, the information measures provided for in application of
Regulation (EU) 2016/679 of April 27, 2016 referred to above and in Articles 58, 69 and
70 of the aforementioned law of 6 January 1978 as well as the justification of any
request for exemption from the information obligation provided for in Article 58;

6 ° The characteristics of the processing, in particular the retention period
Datas ;

7 ° Where applicable, the scientific and technical justification of any
request for exemption from the prohibition on keeping data under
a nominative form beyond the duration necessary for the research;

8 ° Opinions previously rendered by scientific bodies or
ethics provided for by legislative or regulatory provisions;

9 ° The mergers or interconnections envisaged or any other form
linking information;

10 ° The measures taken to ensure the security of processing and
information and the guarantee of secrets protected by law;

11 ° Where appropriate, the mention of any transmission of data to
personal character to a State which does not belong to the European Union;

12 ° If applicable, the list of treatments meeting the characteristics
provided for in IV of article 66 of the aforementioned law of 6 January 1978. The folder
specifies, in this case, the categories of data, the recipients or
categories of recipients and the justification for using the
single decision.

Page 41

The single secretariat verifies that each file produced in support of a
application includes all of the above items.

Any modification of these elements must be brought to the attention of the
aforementioned secretariat which, if necessary, informs the authorities
competent.
Article 90

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
The ethical and scientific committee for research, studies and
evaluations in the field of health, mentioned in 2 ° of article 76 of
the law of January 6, 1978 referred to above and seized by the single secretariat mentioned
in article 88 of this decree, issues an opinion on the methodology adopted,
on the need for recourse to personal data, on the
relevance of these in relation to the purpose of the processing and, if applicable,
on the scientific and ethical relevance of the project. If applicable, the committee
recommends that applicants make changes to their project in order to
comply with the obligations provided for by the law of 6 January
1978 above.
The opinion delivered by the committee is reasoned.

As soon as the committee has delivered its opinion, it is notified to the secretariat.
unique, by any means allowing to date the reception of this
notification.

The opinion delivered by the committee is sent to the authorization requester.

At the expiration of a period of one month from the date of receipt of the
complete file by the committee, the opinion of the committee is deemed favorable.

The time limit mentioned in the previous paragraph may be extended once, for
a period of one additional month, by decision of the chairman of the committee.

Page 42

In an emergency, the time limit mentioned in the fifth paragraph may be reduced.
fifteen days, under the conditions provided for in article 100.
Article 91

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
When the ethics and scientific committee for research, studies and
the evaluations in the field of health give a favorable opinion, if
tacitly, or a favorable opinion with recommendations,
reserved or unfavorable, the applicant informs the sole secretariat of his
desire to seize or not the National Commission for Informatics and
freedoms. He can correct or complete his authorization request file
on the points on which the refusal, reservations or recommendations were based
of the committee.

When the applicant has informed the secretariat of his wish that the
commission is seized, the aforementioned single secretariat transmits without
deadline the file produced in support of the request accompanied by the opinions
returned, or the notice of receipt or the receipt of the request for an opinion
when this committee has given a tacitly favorable opinion to the committee,
which decides under the conditions provided for in V of article 66 of the law of
January 6, 1978 referred to above.

The single secretariat informs the ethics and scientific committee for
research, studies and evaluations in the field of human health
follow-up given to his opinion.

The single secretariat is at the disposal of the authorization requester,
information relating to the progress of the investigation of its
file until the authorization issued by the commission.
Article 92

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
When it is seized by the president of the National Commission of
data processing and freedoms or by the minister in charge of health, in
application of the second paragraph of article 72 of the law of 6 January 1978
aforementioned, the question of the public interest nature of the processing of

Page 43

personal data for research, study or
assessment subject to an authorization request, the ethics committee
and scientific for research, studies and evaluations in the
health sector is issued within one month. The Secretary
single mentioned in Article 88 informs the applicant that the committee has been
seized of this matter. The opinion is sent to the author of the referral and to the
applicant.

When the committee examines, under the conditions provided for in Article 90, the
file of an authorization request relating to the processing of data
personal character concerning research not involving the
human person, a study or an evaluation, it can, of its own
initiative, to express its opinion in its opinion on the public interest nature of this
treatment.
Paragraph 2: Composition and functioning of the ethics committee and
scientific research, studies and evaluations in the
health sector (CESREES) (Articles 93 to 100)
Article 93

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
The ethical and scientific committee for research, studies and
evaluations in the field of health, which sits with the ministers
in charge of health and research, includes, in addition to its chairman:

1 ° Three qualified personalities appointed by the minister responsible for
health;

2 ° Three qualified personalities appointed by the minister responsible for
research ;

3 ° An expert proposed by the National Health Insurance Fund;

4 ° An expert proposed by the National Institute of Health and Research
medical;

Page 44

5 ° An expert proposed by the National Center for Scientific Research;

6 ° An expert proposed by the National Institute for Research in Computer Science and
in automatic;

7 ° An expert proposed by the National Institute of Statistics and Studies
economic;

8 ° An expert proposed by the National Conference of Directors General
regional and university hospitals;

9 ° An expert proposed by the Conference of Deans of Faculties of
medicine;

10 ° An expert proposed by the Conference of University Presidents;

11 ° A member of the Council of State proposed by its vice-president;

12 ° A representative of the National Consultative Ethics Committee, proposed by
this one ;

13 ° A representative of the French interministerial archives service,
offered by this service;

14 ° Two representatives of the National Union of Approved Associations
users of the health system provided for in Article L. 1114-6, proposed by
this one;

Page 45

15 ° A person representing private actors in the health sector.

The chairman and members of the committee are appointed by joint decree of the
Minister responsible for health and the Minister responsible for research for a
five-year term renewable once. In the event of resignation or death,
they are replaced for the remainder of their term of office.

Qualified personalities and experts are chosen because of their
skills in ethical or legal matters, in research
in the fields of health, epidemiology, genetics,
biostatistics or human and social sciences or in matters of
algorithmic processing or processing of personal data
personnel in the field of health.

The committee elects a vice-president from among its members.

The committee may call on external experts appointed by the
chairman of the committee. These experts are subject to the obligations provided for by
Article L. 1452-3 of the Public Health Code. The committee may also
solicit representatives of the organizations that hold the data
concerned by processing requests.

Committee members and external experts are bound to secrecy
professional.
Article 94

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
The ethical and scientific committee for research, studies and
evaluations in the field of health is entered, prior to the
referral to the National Commission for Informatics and Liberties,
any request for the implementation of personal data processing
personnel whose aims are research, study or evaluation in the

Page 46

field of health and not involving the human person,
in accordance with 2 ° of article 76 of the aforementioned law of 6 January 1978.

In accordance with the second paragraph of article 72 of the law of January 6, 1978
aforementioned, the committee can rule on the public interest nature of a
processing of personal data for research purposes,
study or evaluation in the field of health at the request of the
President of the National Commission for Informatics and Liberties or of the Minister
responsible for health, or on its own initiative when it examines, in the
conditions provided for in Article 90, the file of an application for authorization
relating to the processing of personal data. he can
also be consulted by the ministries concerned, by the commission,
by the Health Data Platform and by public bodies and
private individuals who use personal data processing
in this domain.

The meaning of the opinion rendered by the committee is published by the Platform for
health data. For treatments authorized by the commission, the
motivation for the committee's opinion is published by the Data Platform
health at the end of the research, study or evaluation.
Article 95

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
I.- The ethical and scientific committee for research, studies and
evaluations in the field of health can only validly sit if
at least half of its members are present. It delivers its opinions to the
majority of members present. In the event of a tie vote, that of the
president is decisive. Committee meetings are not public.

II.-The ethical and scientific committee for research, studies and
evaluations in the field of health adopts internal regulations which
defines the modalities of its operation These internal regulations may
in particular to provide for procedures without debate for the treatments
similar to those that the committee has already considered, i.e.
processing for the same purpose, relating to categories of
identical data and having identical recipient categories. He
is approved by joint order of the Minister responsible for health and
Minister in charge of research.

Page 47

The chairman may delegate his signature to a member of the ethics committee and
named scientist.
Article 96

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
The ethical and scientific committee for research, studies and
evaluations in the health field may hear the person responsible for
treatment or its representative.
Article 97

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
Members of the ethics and scientific committee for research,
studies and evaluations in the field of health, including its
president and his vice-president, and the external experts to whom he
call receive, in the exercise of their mission, an indemnity of which the
amount is set by order of the Minister of Health. They are entitled, in
in addition to reimbursement of the costs incurred by the execution of their
mission, under the conditions provided for by the aforementioned decree of July 3, 2006.
Article 98

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
Files, reports, deliberations and opinions are kept by the committee
ethics and science for research, studies and evaluations
in the field of health under conditions ensuring their
confidentiality, for a maximum period of ten years, before their
transfer to the National Archives.
Article 99

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
The ethical and scientific committee for research, studies and
evaluations in the health sector draw up an annual activity report
which is addressed to the minister in charge of research, to the minister in charge of
health, social affairs and social security and to the president of the
National Commission for Informatics and Freedoms.
Article 100

Page 48

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
In case of emergency, the minister in charge of research or the minister in charge of
of health, social affairs and social security can ask the
ethics and scientific committee for research, studies and
evaluations in the health field to take a decision within a timeframe that may
be reduced to fifteen days. He informs the applicant and the secretariat.
unique.
Paragraph 3: Composition and functioning of the audit committee of the
national health data system (Articles 101 to 106)
Article 101

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
The audit committee provided for in article 77 of the aforementioned law of 6 January 1978 is
chaired by the senior defense and security official of the ministries
in charge of social affairs who can delegate this function to
departmental information systems security officer
responsible for social affairs and health.

The audit committee is made up of:

1 ° The director of research, studies, evaluation and
statistics or its representative;

2 ° The delegate for health information systems strategy or his
representative;

3 ° The director of the National Health Insurance Fund, responsible for
processing of the national health data system, or its representative
;

4 ° The director of the Technical Agency for Information on Hospitalization
or his representative;

Page 49

5 ° The director of the National Institute of Health and Medical Research
or his representative;

6 ° The director of the National Solidarity Fund for Autonomy or his
representative;

7 ° Representatives of complementary health insurance organizations;

8 ° The president of the Health Data Platform, responsible for
processing of the national health data system, or its
representative;

9 ° A person representing private actors in the health sector;

10 ° A qualified person.

The persons mentioned in 7 °, 9 ° and 10 ° are designated by order of
Minister responsible for social affairs and health, on a proposal from the
chairman of the audit committee.

The president of the National Commission for Informatics and Freedoms or
its representative attends the audit committee as an observer.

The audit committee meets at least twice a year when convened by
its president.

On the basis of the guidelines adopted by the audit committee, its chairman
decides on the audits to be carried out each year on all systems
gathering, organizing or making available all or part of the data

Page 50

of the national health data system for research, study
or evaluation and on the systems making up the national
health data.

The audit strategy as well as the audit schedule are transmitted
by the chairman of the audit committee to the chairman of the National Commission
computing and freedoms.
Article 102

The audits are carried out by independent service providers.
If the scope of the audit involves individual medical data, the
selected service provider must provide for the presence of a doctor with
auditors for all aspects of the audit relating to this data.
The chairman of the audit committee monitors the implementation of the audits and reports
account to the committee.
The audit committee and the service provider base their action on an audit charter
defined by order of the Minister in charge of social affairs and health
after opinion of the National Commission for Informatics and Freedoms.
Article 103

The chairman of the audit committee sends a notification to the audited entity for
notify him of the audit. This notification recalls in particular the purpose of the
mission, the identity of the auditors, the audit procedure, the right to object to
the audit of the audited entity which can be carried out at any time as well as the
deadlines and remedies for the audited entity.
If the audited entity discloses its right to object to the audit, the auditors
immediately alert the chairman of the audit committee, who immediately informs the
President of the National Commission for Informatics and Freedoms.
Auditors have access from 8 a.m. to 8 p.m., for the exercise of their
missions, places, premises, enclosures, installations or establishments
used for the implementation of the processing of personal data
personnel, excluding the parts of these assigned to the private home.

Page 51

For the performance of their duties, the auditors may request
communication of all documents, whatever the medium, and take them
copy. They can collect, in particular on the spot or on convocation, any
information and any useful justification. Listeners can access,
under conditions preserving confidentiality with regard to third parties,
computer programs and data, as well as requesting
transcription by any appropriate processing into documents directly
usable for audit purposes.
The auditors can make any useful finding. Listeners
may in particular, from a communication service to the public in
online, consult the data freely accessible or made accessible.
Auditors can transcribe the data by any processing
appropriate in documents directly usable for the needs of
the audit.
In the event of difficulties during the audit, the audited entity may refer the matter to the chairman
of the audit committee to ensure that the behavior of the
service provider and its auditors to the requirements arising from the law of 6
January 1978 referred to above, of this decree, of the audit charter mentioned in
Article 102 and clauses of the public contract on the basis of which they
intervene.
Article 104

The audit gives rise to a report which is transmitted, for contradiction, to the entity
audited. This report recalls the purpose of the mission, its members,
the people met, their statements if applicable, the
requests made by the auditors as well as any difficulties
encountered. The shortcomings and dysfunctions noted by the
auditors to the law of 6 January 1978 referred to above and to the provisions of the
public health related to the national health data system are
recorded in these reports as well as the resulting recommendations.
The report is signed by the auditors. It is sent, after validation by the
Chairman of the Audit Committee, by the latter by registered letter with
acknowledgment of receipt to the audited entity.
When the audit leads to access to individual medical data, the
doctor appointed by the provider records in a report the
checks he made without reporting medical data
individual to which he had access. The report, after validation by the

Page 52

Chairman of the Audit Committee, is sent by the latter by letter
registered with acknowledgment of receipt to the inspected entity.
The audited entity has a period of one month to respond from the
receipt of reports. Its responses must include an action plan and
a timetable for the implementation of its actions.
In view of the responses of the audited entity, its action plan and its
implementation schedule, auditors formalize reports
final. These final reports are signed by the auditors and the president.
of the audit committee, after validation by the latter. They are sent to
entities audited by registered letter with acknowledgment of receipt by the
chairman of the audit committee.
The final reports are systematically sent to the president of the
National Commission for Informatics and Freedoms, and to all bodies
of control who request it.
All the supporting documents are sent by the auditors to the
chairman of the audit committee.
Article 105

The audited entities report to the chairman of the audit committee and to
auditors of the implementation of their action plan every six months or
according to the schedule agreed by the parties. Audited entities must provide
on this occasion any document justifying this implementation.
The chairman of the audit committee and the auditors monitor the implementation of
these action plans.
Article 106

The chairman of the audit committee reports annually to the minister
in charge of social affairs and health as well as the strategic committee of
the audit strategy of the audit committee, audits carried out, at the global level
control of operations, significant problems observed as well as
recommendations made to comply with the legislation in force,
standards and reduce risks.
The chairman of the audit committee presents the main conclusions and
audit recommendations to the audit committee.

Page 53

Paragraph 4: Composition and functioning of protection committees
of persons (Article 107)
Article 107

The composition and functioning of the protection committees
persons are set by Articles R. 1123-1 et seq. of the French Code of
public health.
Sub-section 3: Simplified procedures (Articles 108 to 110)
Article 108

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
The president of the ethics and scientific committee for research, studies
and evaluations in the field of health, sitting in the assembly
of the Health Data Platform, may have recourse to
members of the ethics and scientific committee to participate in the formalization
standards and standard regulations mentioned in II of article 66 of the law of
January 6, 1978 referred to above as well as reference methodologies
mentioned in article 73 of the same law.

The National Commission for Informatics and Liberties or, by delegation, the
president or deputy vice-president establishes these standards and regulations
types and homologates these reference methodologies. These are published in
Official Journal of the French Republic.
Article 109

Modified by Decree n ° 2020-567 of May 14, 2020 - art. 1
The Health Data Platform can send the National Commission
IT and freedoms of contributions with a view to possible
recommendations of the latter relating to the processing referred to in section 3
of Chapter III of Title II of Law No. 78-17 of 6 January 1978 and mentioned in
article 8 of the same law.

Page 54

These proposals are made public. They can apply to
categories of operations that may constitute independent stages of
automated processing.

Application files may refer to published recommendations
by the commission.
Article 110

When the controller or a category of processing
similar personal data has made a declaration of
compliance with one of the standards, one of the model regulations or one of the
reference methodologies approved in accordance with Article 108, only
this declaration is sent to the commission which acknowledges receipt. The
data controller keeps up to date the list of data processing included in the
part of a declaration of conformity. For treatments that are not
recorded in the public directory mentioned in article L. 1121-15 of the code
public health, treatments are recorded in a public directory
made available by the single secretariat.
Sub-section 4: Procedures for informing data subjects (Articles
112 to 115)
Article 112

People accommodated in establishments or centers where
carry out activities of prevention, diagnosis and care giving rise to
the transmission of personal data for the purpose of processing
personal data in the field of health covered by the
section 3 of chapter III of title II of the aforementioned law of 6 January 1978 are
individually informed of the information prescribed by regulation (EU)
2016/679 of April 27, 2016 referred to above by the delivery of a document or by any
other appropriate means enabling them to gain useful knowledge of
these mentions.
Article 113

Page 55

The person who intends to oppose the processing of personal data
personnel in the field of health concerning her may express her refusal
by any means with either the controller or
the institution or health professional holding this data
except in the case provided for in II of article R. 1461-9 of the health code
public.
Article 114

When the research, study or evaluation requires the examination of
genetic characteristics, the consent of the data subject or of
its legal representatives must be collected, prior to processing, under
written form. If it is not possible to collect it in this form, the
express consent of the data subject is attested by a third party
independent of the body implementing the treatment.
Article 115

Articles 39 to 43 of this decree are applicable when a sanction is
likely to be pronounced in application of articles 20 and 21 of the law of 6
January 1978 referred to above.
Section 3: Processing for archival purposes in the public interest, for the purposes of
scientific or historical research or for statistical purposes (Article 116)
Article 116

The exemptions provided for in the second paragraph of article 78 of the law of 6 January
1978 referred to above relating to processing for scientific research or
historical or statistical purposes only apply in cases where the
rights provided for in Articles 15, 16, 18 and 21 of Regulation (EU) 2016/679 of April 27
2016 above would risk making it impossible or seriously hampering the
achievement of specific purposes and where such derogations are necessary
to achieve these ends.
The data resulting from these treatments kept by the person in charge of
processing or its subcontractor can only be accessed or modified by
authorized persons. These people respect the rules of ethics
applicable to their sectors of activity. Authorizations granted by

Page 56

data controllers to these persons respect the specific purposes
of the previous paragraph as well as the guarantees provided for in the following paragraph.
These data cannot be disseminated without having first been
anonymized unless the interest of third parties in this dissemination prevails over the interests or
the fundamental rights and freedoms of the data subject. For the results
of research, this dissemination must be absolutely necessary for its presentation.
The data disseminated must be adequate, relevant and limited to what is
necessary for the purposes for which they are processed. Diffusion
of personal data contained in documents consulted in
application of article L. 213-3 of the heritage code can only take place after
authorization of the archives administration, after agreement of the authority whose
emanate from the documents and opinions of the statistical confidentiality committee set up by article
6 bis of the law n ° 51-711 of June 7, 1951 on the obligation, the coordination and the secrecy
in terms of statistics with regard to data covered by secrecy
in terms of statistics.
Chapter IV: Rights and obligations specific to processing in the
electronic communications (Articles 117 to 122)
Article 117

This chapter applies to processing operations falling under Chapter IV of Title II of the
Law of January 6, 1978 referred to above.
The rights and obligations mentioned in Chapters II and III apply subject to
specific provisions of this chapter.
Article 118

The notification of a personal data breach provided for in the first
paragraph of II of article 83 of the aforementioned law of 6 January 1978 is addressed to the
National Commission for Informatics and Liberties by letter delivered against
signature or electronically specifying the nature and consequences of the
personal data breach, measures already taken or proposed
by the provider of electronic communications services accessible to the
public to remedy it and the persons to whom information
can be obtained and, where possible, an estimate
the number of people likely to be affected by the violation in question.
Article 119

Page 57

The notification of a personal data breach provided for in
second paragraph of II of article 83 of the law of 6 January 1978 is addressed to the
person interested in any means allowing the service provider to
publicly available electronic communications to provide proof of
the completion of this formality. This notification specifies the nature of the
breach of personal data, the persons with whom
additional information can be obtained as well as the measurements that the
supplier recommends that the person concerned take to mitigate the
negative consequences of this violation.
However, this notification is not necessary if the National Commission for
data processing and freedoms has found that the appropriate protection measures
within the meaning of Article 120 and on which it has ruled under the conditions
provided for in Articles 121 and 122 have been implemented by the supplier and
effectively applied to the data affected by this breach.
Article 120

Constitutes an appropriate protective measure, within the meaning of article 83 of the law of 6
January 1978, any effective technical measure intended to render the data
incomprehensible to anyone who is not authorized to have access to it.
Article 121

To inform the National Commission for Informatics and Freedoms of the measures
protection that it implements and that it has applied to the particular case, the
supplier sends him, by any means allowing proof of their
notification, the following information:
1 ° The surname, first name, address and telephone number of the person responsible for
treatment ;
2 ° The description of the protection measures;
3 ° The provisions planned and applied to give full effectiveness to these
measures ;
4 ° Where applicable, the references of the formalities file completed with the
commission prior to the implementation of the processing in question;

Page 58

5 ° Whether or not the notification formality provided for to the person
interested in Article 119 and, if not, the reasons justifying the absence of
notification.
Article 122

The National Commission for Informatics and Freedoms verifies within a period of
two months if the appropriate protective measures have been implemented and
applied and assesses the seriousness of the particular case of the data breach to
personal character.
The silence kept by the committee at the end of this period constitutes
non-application to the specific case of appropriate protective measures and entails
for the supplier, if he has not already informed the interested party, the obligation to
make the notification provided for in Article 119. This period only starts from the
full receipt of the information provided for in Article 121.
If the supplier has not already notified the interested person of the violation of these
data pursuant to Article 119, the committee may, in addition, when
considers the violation to be serious, give notice to the supplier to inform it
application of the last paragraph of II of article 83 of the law of 6 January 1978 in a
period which cannot be longer than one month.
Chapter V: Provisions governing the processing of personal data
personnel relating to deceased persons (Articles 123 to 124)
Article 123

This chapter applies to processing operations falling under Chapter V of Title II of the
Law of January 6, 1978 referred to above.
For the implementation of the rights mentioned in I and II of article 85 of the law of 6
January 1978 referred to above, the rights mentioned in Title II of this decree apply
subject to the specific provisions of this chapter.
Article 124

In addition to proof of identity, the heir of a deceased person who wishes
exercise the rights mentioned in I and II of article 85 of the law of January 6, 1978

Page 59

aforementioned must, at the time of his request, provide proof of his status as heir by the
production of an act of notoriety or a family record book.
Chapter VI: Transfers of personal data to States
not belonging to the European Union (Articles 125 to 128)
Article 125

For the transfer of personal data to a State that does not belong to
the European Union or to an international organization, the National Commission for
data processing and freedoms can authorize contractual clauses and
administrative arrangements mentioned in a and b of 3 of article 46 of the regulations
(EU) 2016/679 of April 27, 2016 referred to above. The committee takes a decision within a
two months from receipt of the request according to a defined procedure
in its internal regulations. However, this period can be renewed once on
reasoned decision of its president. When the committee has not made a decision
within these time limits, the request is deemed to be rejected.
The implementation of the consistency control mechanism provided for in section 2
of Chapter VII of Regulation (EU) 2016/679 of 27 April 2016 referred to above suspends the
deadlines mentioned above.
Article 126

When a transfer takes place in application of b of 3 of Article 46 of Regulation (EU)
2016/679 of April 27, 2016 referred to above, the administrative arrangement founding this transfer
is published on the website of the National Commission for Informatics and
freedoms.
Article 127

When to effect a transfer to a State which does not belong to the Union
European Union, the controller or the processor is based on a code
of conduct or certification mechanism approved in accordance with Articles
72 and 74 of this decree, it transmits to the National Commission for Informatics and
of freedoms a binding and enforceable commitment made by the person responsible for
processing or subcontractor in the third country to apply the appropriate guarantees,
including with regard to the rights of data subjects.
Article 128

Page 60

When a transfer takes place in application of the last paragraph of 1 of article 49 of the
Regulation (EU) 2016/679 of April 27, 2016 referred to above, the controller
provides the data subject with the specific information mentioned in this
indentation. The National Commission for Informatics and Freedoms defines models
relating to its own information and establishes the list of appendices which, where applicable,
must be attached.

Title III: PROVISIONS APPLICABLE TO TREATMENTS UNDER
DIRECTIVE (EU) 2016/680 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
OF APRIL 27, 2016 RELATING TO PERSONAL PROTECTION
PHYSICAL WITH REGARD TO THE PROCESSING OF PERSONAL DATA
STAFF BY COMPETENT AUTHORITIES FOR THE PURPOSES OF
PREVENTION AND DETECTION OF CRIMINAL OFFENSES,
INQUIRIES AND PROCEEDINGS IN THE MATTER OR THE EXECUTION OF
PENAL SANCTIONS, AND THE FREE MOVEMENT OF THIS DATA,
AND REPEALING FRAMEWORK DECISION 2008/977 / JHA OF THE COUNCIL (Articles
129 to 139)
Chapter I: General provisions (Articles 129 to 132)
Article 129

This Title applies, without prejudice to Title I, to processing operations falling under Title
III of the aforementioned law of 6 January 1978.
Article 130

I. - The fact that a type of treatment is likely to generate a high risk for
the rights and freedoms of natural persons requiring the realization of a
impact analysis pursuant to article 90 of the aforementioned law of 6 January 1978 is
determined by the use of new technologies, and taking into account the nature,
the scope, context and purposes of the processing.
When a type of processing relates to data mentioned in I of article 6
of the same law, it is deemed likely to create a high risk for the rights
and the freedoms of natural persons.

Page 61

II. - The types of processing which relate to a set of processing operations
similar and have similar high risks may be subject to
joint impact assessment. This common analysis is, if necessary, supplemented
by each of the data controllers concerned, depending on the specifics
of his treatment.
III. - The impact assessment contains at least a general description of the operations
planned treatment, an assessment of the risks to the rights and freedoms of
the persons concerned, the measures envisaged to deal with these risks, the
safeguards, measures and security mechanisms aimed at ensuring the protection of
personal data and to provide proof of compliance with the provisions
of Titles I and III of the same law, taking into account the rights and legitimate interests
affected people and other affected people.
IV. - When the National Commission for Informatics and Freedoms is consulted
prior to the implementation of the processing under the conditions provided for in
third paragraph of Article 90 of the same law, the controller or the
subcontractor provides it with the impact analysis relating to data protection and, on
request any other information enabling it to assess the compliance of the
treatment in accordance with the provisions of Titles I and III of the same law and, in particular, the

risks for the protection of personal data of individuals
concerned and the related guarantees.
V. - When the commission is of the opinion that the processing would constitute a violation
of the provisions of Titles I and III of the same law, in particular when the
controller has not sufficiently identified or mitigated the risk, it
provides written notice to the controller and, where applicable, to the processor
within eight weeks of receipt of the consultation. If the
complexity of the planned treatment requires it, this period may be extended by six
weeks. In this case, the commission informs the controller and,
if applicable, the subcontractor for the extension of this period, within six
weeks from receipt of the consultation, as well as the reasons for this
extension.
The National Commission for Informatics and Liberties can also advise
the controller and make use of the powers referred to in f of 2 ° of I of
article 8 and I, 2 ° and 4 ° of II and 1 ° to 3 ° of III of article 20 of the same law.
In the absence of a response from the committee to its consultation within the period of eight
weeks, if necessary extended by six weeks, the controller or
where appropriate, the subcontractor can implement the data processing, without
prejudice to the exercise by the committee of the powers mentioned in the seventh
paragraph of this article.
Article 131

Page 62

The contract or other legal act binding the subcontractor with regard to the person responsible for the
processing, mentioned in article 96 of the aforementioned law of 6 January 1978, provides
in particular that the subcontractor:
1 ° Ensure that the persons authorized to process personal data
personnel undertake to respect confidentiality or are subject to a
appropriate legal obligation of confidentiality;
2 ° Help the controller, by any appropriate means, to ensure compliance
the provisions of Chapter III of Title III of the same law;
3 ° According to the choice of the controller and subject to a possible
archiving in the public interest, deletes all personal data
or send them back to the controller at the end of the service
data processing, and destroy existing copies;
4 ° Makes all information available to the controller
necessary to provide proof of compliance with Article 96 above and the
this article;
5 ° Respects, to recruit another subcontractor, the conditions set out in 2 of
Article 28 of Regulation (EU) 2016/679 of April 27, 2016 referred to above, in the last paragraph
of the aforementioned article 96 and this article.
This legal act takes written form, including electronic form.
Article 132

When two or more controllers jointly determine the
purposes and means of processing, they are jointly responsible for the
treatment. Joint controllers define in a way
transparent about their respective obligations in order to ensure compliance with
obligations of which they are debtors in application of the aforementioned law of 6 January 1978
and the decree, particularly with regard to the exercise of human rights
concerned, and their respective obligations regarding the communication of
information referred to in article 104 of the same law, by agreement between them, except
if, and to the extent that their respective obligations are defined by the law of
the European Union or by the law of the Member State to which those responsible for
treatment are submitted. The point of contact for data subjects is
mentioned in the act initiating the treatment, or when this treatment is not
implemented on behalf of the State, in the agreement between those responsible
spouses of treatment.

Page 63

If the point of contact has not been appointed or if its designation has not been made
public, the data subject can exercise their rights with regard to and against
each of the data controllers.
Chapter II: Obligations incumbent on the competent authorities, on those responsible
of personal data processing and to processors (Article 133)
Article 133

A data protection officer is appointed by the data controller
in the cases provided for in article 103 of the aforementioned law of 6 January 1978.
The data controller publishes the contact details of the data protection officer
data and communicates them to the National Commission for Informatics and
freedoms under the conditions provided for in Article 83.
When local authorities, their groups, public establishments
premises and private law legal entities managing a public service designate a
sole data protection officer, an agreement determines the conditions
in which pooling is carried out. Each of the parties to the pooling
remains controller or processor.
Chapter III: Rights of the data subject (Articles 134 to 137)
Article 134

The controller takes appropriate measures to provide any
information referred to in article 104 of the aforementioned law of 6 January 1978. He proceeds to
any communication to the data subject, provided for in Articles 102, 105 to
107 of the same law, in a concise, understandable and easily accessible manner, in
clear and simple terms.
Article 135

When the data subject makes a request, including by way of
electronic, tending to the implementation of the rights provided for in II of article 104 and
in articles 105 and 106 of the aforementioned law of 6 January 1978, it justifies its
identity by any means and specifies the address to which the response must be sent. It
can exercise their rights by using digital identity data when these

Page 64

data are necessary and considered sufficient by the controller
to authenticate its users.
When the controller has reasonable doubts as to the identity of
the person, he can request the additional information appearing
necessary, including, when the situation so requires, a copy of an identity document
bearing the signature of the holder.
When the request presented on the spot cannot be satisfied immediately, it
an acknowledgment of receipt, dated and signed, is issued to its author.
When there is reasonable doubt as to the identity of the applicant or the address
postal mail to which the data subject has requested transmission in writing
information about it, the response can be sent by registered mail
without acknowledgment of receipt, the address and identity being verified when
the delivery of the fold.
If the request is imprecise or does not contain all the elements allowing the
data controller to carry out the operations requested,
the latter invites the applicant to provide them before the expiry of the period provided for in
eighth paragraph. The controller does this by letter delivered against
signature or electronically. The request for additional information
suspends the period provided for in the eighth paragraph.
When the controller, processor or protection officer
of the data is not known to the requester, he can send his request to
registered office or at the functional e-mail address of the legal person, authority
government, service or body responsible for processing. The demand is
transmitted immediately to the controller.
These requests can be presented by a person specially authorized to
this effect by the applicant, after proof of his identity and the identity of the
principal, of his mandate as well as of the duration and the precise object of this one. The
mandate must also specify whether the agent can be made addressee of the
response from the controller or processor.
Without prejudice to the specific provisions applicable to certain processing operations, the
controller responds in writing to the request made by the data subject
within two months of receipt and under the conditions set out in
section 80.
The period provided for in the eighth paragraph is suspended when the controller
or the subcontractor has requested additional information necessary to
identify the person concerned or carry out the operations requested of him.

Page 65

When the controller has not given an opinion within the time limit set in
eighth paragraph, the request is deemed rejected.
Article 136

Without prejudice to the specific provisions applicable to certain processing operations,
requests made in application of article 108 of the aforementioned law of 6 January 1978
are governed by the provisions of Articles 141 to 143, except in the case of information
falling under article 111 of the same law. Under penalty of inadmissibility of his request, the
the person concerned must justify to the National Commission of
data processing and freedoms either from the written response of the controller
attesting to the restriction of his rights in application of II or III of
article 107 of the same law, or of the request it addressed to the latter more
two months previously under section 135.
Article 137

The controller with whom the right to object has been exercised
inform without delay of this opposition any other data controller that he has
made recipient of the personal data which is the object of the opposition.
Chapter IV: Cooperation (Article 138)
Article 138

For the implementation of article 26 of the aforementioned law of 6 January 1978, the
provisions of 2, 3, 6 and 7 of article 61 of regulation (EU) 2016/679 of April 27
2016 above are applicable.
Chapter V: Transfers of personal data to States
not belonging to the European Union or to recipients established in
States not belonging to the European Union (Article 139)
Article 139

When a transfer of personal data takes place in application of the
articles 112 and 114 of the aforementioned law of 6 January 1978, the National Commission for
data processing and freedoms can edit forms indicating the elements
of information to be transmitted under these articles.

Page 66

Title IV: PROVISIONS APPLICABLE TO TREATMENTS CONCERNING
STATE SECURITY AND DEFENSE (Articles 140 to 151)
Article 140

This Title applies, without prejudice to Title I, to processing operations falling under Title IV
of the law of January 6, 1978 referred to above.
Sub-section 1: Exercise of rights with the National Commission for
data processing and freedoms (Articles 141 to 143)
Article 141

Pursuant to article 118 of the aforementioned law of 6 January 1978, any request
access, rectification or erasure of the information contained in the
processing relating to State security or defense, authorized in application of
1 ° of I of article 31 of the aforementioned law of 6 January 1978, is addressed to the
commission in writing.
The request must be signed and accompanied by a photocopy of an identity document
bearing the signature of the holder. It must specify the address to which the
reply. When there is any doubt as to the address given or the identity of the
applicant, the committee's response can be sent by post
delivery against signature, verification of the address or identity of the applicant
taking place when the envelope is delivered.
Any manifestly abusive request may be rejected.
Article 142

Seized under the conditions set out in article 141, the commission notifies the applicant,
within four months of its referral, without prejudice to
specific provisions applicable to certain processing operations, the result of its
investigations. If the request does not contain all the elements allowing the
commission to carry out the investigations which have been requested of it, the latter invites
the applicant to provide them. In the absence of a response from the applicant within
two months, the request may be rejected. The four-month period runs from
the date of receipt by the committee of this additional information.

Page 67

If the response to demand requires the prior centralization of parts and
elements, the controller shall do so within three months of
from the date on which he receives the commission's request. This delay may
be extended by one month when the processing of the request requires
complex investigations. The committee is informed of the extension of this deadline
by the controller. The time limit within which the commission responds to the
applicant is then extended to five months. The timeframe enjoyed by the person responsible for
processing is charged to the period provided for in the previous paragraph.
Without prejudice to the specific provisions applicable to certain processing operations,
when the committee requests the opinion of an authority exercising powers
similar to his in another Member State of the European Union or a
Third State, the period of four months mentioned in the first paragraph runs from the
receipt by the committee of the information it has requested.
Article 143

I. - According to its investigations, the commission finds, in agreement with the
controller, those of the data whose communication to the requester
does not call into question the purposes of the processing, State security, defense or
public security. It transmits this data to the requester. If applicable,
these are communicated according to modalities defined by mutual agreement
between the commission and the controller.
When the controller opposes the communication to the requester
of all or part of the data concerning him, the commission informs him that he has
the necessary verifications have been carried out.
When the processing does not contain any data concerning the applicant, the
commission informs the latter, with the agreement of the controller. In case
opposition from the data controller, the commission merely informs the
applicant that the necessary verifications have been carried out.
II. - The commission may note, in agreement with the controller, that
the data concerning the applicant must be rectified or deleted and that there
should inform him. In the event of opposition from the controller, the
commission merely informs the applicant that the verifications have been carried out
required.
III. - The committee's response mentions the avenues and time limits for appeal
to the requester. For requests relating to processing or parts of
processing relating to State security mentioned in Article R. 841-2 of the French Code of
internal security, the reference to legal remedies specifies that the Council of State
can be entered within two months from the notification of the information according to

Page 68

which the necessary verifications have been carried out and recalls the provisions of
Article L. 841-2 of the same code.
Sub-section 2: Exercise of rights with the controller (Articles
144 to 146)
Article 144

When the data subject makes a request, including by way of
electronic, tending to the implementation of the rights provided for in Articles 117 and 119 of
the law of January 6, 1978 referred to above, it justifies its identity by any means. She can
exercise their rights by using digital identity data when these
data are necessary and considered sufficient by the controller
to authenticate its users.
When the controller or processor has reasonable doubts
as to the identity of this person, he can request the information
additional appearances necessary, including, when the situation so requires, the
copy of an identity document bearing the signature of the holder.
The time limits provided for in Article 146 are suspended when the controller
or the subcontractor has requested additional information necessary to
the identification of the person concerned. When there is a reasonable doubt about
the identity of the applicant or the postal address to which the data subject has
requested the transmission in writing of information concerning him, the answer can be
sent by registered mail without acknowledgment of receipt, verification of the address and
of the identity being made during the delivery of the envelope.
When the controller or the processor is not known to the
applicant, he can send his request to the head office or to the e-mail address
functional of the legal person, public authority, service or
the body responsible for treatment. The request is sent immediately to
controller.
Article 145

When a request is presented on the spot, the person concerned justifies
means of his identity with the controller or processor.
When the request cannot be satisfied immediately, it is issued to its
author an acknowledgment of receipt, dated and signed.

Page 69

Article 146

The data controller or the processor responds to the request made by
the interested party within two months of receipt.
If the request sent by the data subject is imprecise or does not include
not the elements allowing the controller or the processor to
respond, the latter can invite the requester to provide information
complementary before the expiry of the period provided for in the previous paragraph
When the controller or the processor has not commented on
within the time limit provided for in the first paragraph, the application is deemed to be rejected.
Sub-section 3: Information to data subjects (Articles 147 to 148)
Article 147

The controller brings directly to the attention of individuals
from which personal data is collected
information listed in article 116 of the aforementioned law of 6 January 1978 on
collection medium or, failing that, on a document previously brought to their
knowledge in legible characters. In application of 6 ° of I of article 116
mentioned above, it also informs them, under the same conditions, of
contact details of the competent service where they can exercise their rights
opposition, access and rectification.
The information mentioned in the previous paragraph may be communicated to
interested parties, with their consent, by electronic means.
When the information is brought to the attention of the interested party through
display, it is indicated to him that he can, on simple written request, receive these
information in a written medium.
Article 148

The information appearing in 7 ° of I of article 116 of the law of January 6, 1978
aforementioned that the controller communicates, under the conditions provided
in Article 147, to the person from whom the personal data
are collected, are as follows:

Page 70

1 ° The country or countries of establishment of the recipient of the data in cases where this or
these countries are determined during data collection;
2 ° The nature of the data transferred;
3 ° The purpose of the proposed transfer;
4 ° The category or categories of recipients of the data;
5 ° The level of protection offered by the third country (ies): if the third country (ies) does not
do not meet the conditions set out in article 123 of the same law, it is mentioned
the exception provided for in article 124 of this law which allows this transfer or the
decision of the National Commission for Informatics and Liberties authorizing this
transfer.
When the transfer is planned after the collection of the data to
personal character, this can only occur within fifteen days
following receipt by the interested party of the above information or, where applicable, at
end of the procedure referred to in Article 146.
Sub-section 4: Conditions for exercising the right of opposition, the right of access and the
right of rectification (Articles 149 to 151)
Article 149

To facilitate the exercise of the right of opposition provided for in the first paragraph of article 117
of the aforementioned law of 6 January 1978, the person concerned is enabled
to express their choice at any time.
The controller with whom the right to object has been exercised
inform without delay of this opposition any other data controller that he has
made recipient of the personal data which is the object of the opposition.
Article 150

When the controller allows, for the exercise of the right of access
mentioned in article 119 of the aforementioned law of 6 January 1978, the consultation of
data on site, this is only possible subject to the protection of
personal data of third parties. Unless provided by law or
contrary regulations, a copy of the personal data of the
applicant can be obtained immediately.

Page 71

In order for the applicant to be fully aware of it, the manager
processing makes available to the interested party all the data concerning him
and for a sufficient period of time.
When issuing the requested copy, the controller certifies, the
where applicable, the payment of the amount collected in this regard.
Article 151

When personal data has been transmitted to a third party, the
controller who has rectified them immediately informs this
third. The latter also proceeds without delay to the rectification.

Title V: PROVISIONS RELATING TO OVERSEAS (Articles 152 to 155)
Article 152

This decree is applicable in New Caledonia, in French Polynesia, in
the Wallis and Futuna Islands and in the French Southern and Antarctic Territories under
subject to the adaptations provided for in this title.
Article 153

For the application of this decree in Saint-Barthélemy, in Saint-Pierre-et-Miquelon, in
New Caledonia, French Polynesia, the Wallis and Futuna Islands and the
French Southern and Antarctic Lands, the reference to Regulation (EU) 2016/679 of
European Parliament and of the Council of April 27, 2016 on the protection of individuals
physical with regard to the processing of personal data and to the
circulation of these data is replaced by the reference to the rules in force in
metropolitan area under Regulation (EU) 2016/679 of April 27, 2016.
Article 154

Modified by Decree n ° 2019-966 of September 18, 2019 - art. 8

I.- For its application in French Polynesia, New Caledonia,
Wallis and Futuna and in the French Southern Antarctic Territories:

Page 72

1 ° In Article 28, the words: "of the judicial tribunal" are replaced by the words: "of the
court of first instance ”in New Caledonia, French Polynesia and
the Wallis and Futuna Islands;
2 ° In the second paragraph of Article 34, the words: “at least eight days before the date of
his hearing "are replaced by the words:" at least one month before the date of his hearing.
hearing ”;
3 ° In article 36, the words: “the prefect or, as the case may be, the director general of the agency
regional health in whose territorial jurisdiction the control must take place ”are
replaced by the words:
a) “The High Commissioner of the Republic”, in French Polynesia and in
New Caledonia ;
b) "The senior administrator of the Wallis and Futuna Islands", in the Wallis and Futuna Islands
;
c) "The senior administrator of the French Southern and Antarctic Lands", in
the French Southern and Antarctic Lands;
4 ° In Article 40, the words: "has a period of one month" are replaced by the words
: "Has a period of two months";
5 ° In Article 41, the words: "reduced to seven days" are replaced by the words: "
reduced to fifteen days ”;
6 ° In Article 46, the words: "eight days" are replaced by the words: "fifteen days";
7 ° In Article 47, the words: "eight days" are replaced by the words: "fifteen days";
8 ° In the second paragraph of article 58, the words: "eight days" are replaced by the
words: "fifteen days";
9 ° In Article 124, the words: "by the production of an act of notoriety or a booklet of
family ”are replaced by the words:“ by all means ”.
II.-For its application in Mayotte, Saint-Pierre-et-Miquelon, Saint-Barthélemy,
Saint-Martin and La Réunion, in article 36, the words: "the director general of the agency
regional health 'are replaced by the words:
1 ° "The director of the territorial health administration of Saint-Pierre-et-Miquelon"
for Saint-Pierre-et-Miquelon;
2 ° “The director of the health agency of Guadeloupe, Saint-Barthélemy and
Saint-Martin ”for Guadeloupe, Saint-Barthélemy and Saint-Martin;

Page 73

3 ° “The director of the Indian Ocean health agency” for Reunion Island and Mayotte.
NOTE:
In accordance with article 9 of decree n ° 2019-966 of September 18, 2019, these provisions enter into
effective January 1, 2020.

Article 155

In the Wallis and Futuna Islands, in French Polynesia, in New Caledonia and in
the French Southern and Antarctic Lands, the competence devolved to the bailiffs of
justice for the issuance of acts provided for in this decree may be exercised by a
representative of the administrative or military authority.

Title VI: MISCELLANEOUS AND FINAL PROVISIONS (Articles 156 to 160)
Article 156
Modified the following provisions
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 2: Special provisions
relativ ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter II: Human rights
concerned (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter II: The rights of individuals
lost ... (Ab)

● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter II: Measures and sanctions
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter III: Cooperation (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter III: Requests for opinions and
of authorization ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter IV: Special provisions
relati ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter I: Controls and verifications
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter I: General provisions
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter I: General provisions.
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter I: The obligation
incomplete information ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Chapter I bis: Procedure
information on ... (Ab)

Page 74

● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 1: Common provisions
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 1: Common provisions
relating to ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 1: Authorization of agents
of the services ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 1: Restricted training
competent ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 2: Special provisions
to the right ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 2: Authorization of members
and agent ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 2: The ordinary procedure.
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 3: Special provision for
right of ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 3: The emergency procedure.
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 3: On-the-spot checks. (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 3: Simplified procedures
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 4: Special provisions
to the right ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 4: Online control (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 4: Summary proceedings. (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 4: Information procedures
people ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 5: Cooperation and assistance
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 5: Guarantees and exemptions
applicable ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 5: Hearing upon summons.
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 6: Recourse to experts.
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Section 7: Professional secrecy. (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Sub-section 1: Provisions
municipalities (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Sub-section 1: Presentation and
instruction of ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Sub-section 2: Warning and
layoff ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Sub-section 2: Composition and
operation ... (Ab)

Page 75

● Repeals Decree n ° 2005-1309 of October 20, 2005 - Sub-section 3: Composition and
operation ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Sub-section 3: Restricted training
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Sub-section 4: Composition and
operation ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - Sub-section 4: The Commission
national i ... (Ab)
● Repeals Decree No. 2005-1309 of October 20, 2005 - Sub-section 5: Procedure in the event of
circumstance ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - TITLE III: DELEGATES TO THE
PROTECTION OF DO ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - TITLE IV: POWERS OF THE
COMMISSION (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - TITLE IX: PROVISIONS
RELATING TO OVERSEAS. (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - TITLE I: OF THE COMMISSION
NATIONAL INF ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - TITLE V: PROVISIONS
SPECIAL TO TREATIES ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - TITLE VI: OBLIGATIONS
RESPONSIBLE ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - TITLE VII: TRANSFERS OF
CHARACTER DATA ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - TITLE VIII: PROVISIONS
APPLICABLE TO THE TREATIES ... (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - TITLE X: FINAL PROVISIONS.
(Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 1-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 10 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 100 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 100-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 101 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 102 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 103 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 104 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 11 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 110 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 110-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 110-2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 110-3 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 110-4 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 110-5 (Ab)

Page 76

● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 110-6 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 110-7 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 111 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 112 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 113 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 114 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 115 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 116 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 117 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 118 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 119 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 15 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 16 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 17 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 18 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 19 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 19-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 20 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 21 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 22 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 23 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 24 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 25 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 26 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 27 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 28 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 29 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 3 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 30 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 31 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 32 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 32-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 32-2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 32-3 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 32-4 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 32-5 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 32-6 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 33 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 34 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 34-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 34-2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 36 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 37 (Ab)

Page 77

● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 38 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 39 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 4 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 4-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 40 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 41 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 42 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 43 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 44 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 5 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 57 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 58 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 59 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6-2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6-3 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6-4 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6-5 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6-6 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6-7 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6-8 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 6-9 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 60 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 60-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 60-2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 60-3 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 61 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 62 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 62-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 62-2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 62-3 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 63 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 64 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 65 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 65-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 66 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 67 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 68 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 69 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 7 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 70 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 73 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 74 (Ab)

Page 78

● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 75 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 76 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 77 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 78 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 78-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 79 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 8 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 80 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-10 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-3 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-4 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-5 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-6 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-7 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-8 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 81-9 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 82 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 82-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 82-2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 83 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 84 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 85 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 86 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 87 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 88 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 89 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 9 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 90 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 91 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 91-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 91-2 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 91-2-1 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 91-3 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 91-4 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 91-5 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 92 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 93 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 94 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 95 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 96 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 97 (Ab)

Page 79

● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 98 (Ab)
● Repeals Decree n ° 2005-1309 of October 20, 2005 - art. 99 (Ab)
Article 157
Modified the following provisions
● Modifies Decree n ° 2018-232 of March 30, 2018 - art. 2 (V)
● Modifies Decree n ° 2018-232 of March 30, 2018 - art. 3 (V)
● Modifies Decree n ° 2018-232 of March 30, 2018 - art. 4 (V)
Article 158
Modified the following provisions
● Amends Criminal Code - art. R625-10 (V)
● Amends Criminal Code - art. R625-11 (V)
● Amends Criminal Code - art. R625-12 (V)
● Amends Criminal Code - art. R711-1 (M)
● Amends Code of Administrative Justice - art. R555-1 (V)
● Amends Code of Administrative Justice - art. R555-2 (V)
● Modifies the Code of judicial organization - art. R213-5 (V)
● Created Code of judicial organization - art. R532-6-1 (V)
● Modifies the Code of judicial organization - art. R552-6 (V)
● Modifies the Code of judicial organization - art. R562-6 (V)
Article 159

This decree comes into force on June 1, 2019.
Article 160

The Keeper of the Seals, Minister of Justice, and the Minister of Overseas Territories are in charge,
each with regard to the execution of this decree, which will be published in
Official Journal of the French Republic.

Dated May 29, 2019.

Edouard Philippe

Page 80

By the Prime Minister:

The Keeper of the Seals, Minister of Justice,
Nicole Belloubet

The Minister for Overseas,
Annick Girardin


