Law note · France
Loi Informatique et Libertes, GDPR-Aligned Comprehensive Regime (Data Processing, Data Files and Individual Liberties Act)
France gives the General Data Protection Regulation (GDPR) domestic effect through the Loi Informatique et Libertes (Law on Information Technology, Data Files and Civil Liberties), enacted 6 January 1978 and amended for GDPR alignment. Article 6 cross-references Regulation (EU) 2016/679 for the special-category exceptions, Article 8 gives the CNIL authority to prescribe measures for biometric-data processing, and Article 19 sets the CNIL's on-site inspection powers, all confirmed by a direct fetch of the consolidated text. Lawful bases follow the GDPR Article 6 list, with no French derogation identified in this pass.
What it asks of an app
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in France, and follow Loi 78-17 Article 6's cross-reference to GDPR Article 9 for any special-category data.
- Expect the CNIL to hold on-site inspection powers under Loi 78-17 Article 19, and to have authority to prescribe measures for biometric-data processing under Article 8.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: Legifrance, consolidated text (direct fetch)