Privacy & Information Security Law Blog

On February 23, 2017, the French Data Protection Authority (“CNIL”) launched an online public consultation on three topics identified by the Article 29 Working Party (“Working Party”) in its 2017 action plan for the implementation of the EU General Data Protection Regulation (“GDPR”). The three topics are consent, profiling and data breach notification.

This is the second online public consultation that the CNIL has launched on the GDPR. In June 2016, the CNIL launched a public consultation on the right to data portability, the data protection officer, data protection impact assessments (“DPIAs”) and certification. In November 2016, the CNIL published the results of the June 2016 public consultation.

The CNIL’s purpose for launching these consultations is to collect concrete questions regarding the GDPR, potential difficulties in interpreting the GDPR and examples of best practices. The responses are intended to inform the Working Party’s discussion regarding various GDPR topics. The Working Party will finalize guidelines on certification and DPIAs, issue new guidelines on the topics of consent and profiling, and update its opinions and guidance on data breach notifications.

The new consultation will be open through March 23, 2017. It will be followed by a second “FabLab” organized by the Working Party in Brussels on April 5 and 6, 2017, in which relevant stakeholders will be invited to present their views on the new 2017 priorities.