Loi n° 2013-015, automated decisions and rights of data subjects

Article 2 bars any decision producing legal effects for a person from being based solely on an automated processing meant to profile them or evaluate aspects of their personality.

Article 12 gives every person the right to obtain from a controller, free of charge and without delay, communication in an understandable form of all data concerning them and any information available on its origin, together with the information and reasoning used in any automated processing whose results are used against them, and lets the Autorité order appropriate measures where data risk being concealed or made to disappear.

Article 13 gives a person who proves their identity the right to have inaccurate, incomplete, ambiguous, outdated, or unlawfully processed data rectified, completed, updated, blocked, or deleted, requires the controller to justify, free of charge and within thirty days of a written request, that it has done so, puts the burden of proof on the controller in case of dispute, and requires the controller to notify any third party the data were transmitted to of the corrections made.

Article 14 routes an access or rectification request to the Autorité, rather than to the controller directly, where the processing concerns State security, defence, or public security, and has the Autorité designate one of its members to investigate and secure the necessary corrections.

Articles 15 and 16 require a controller, whether or not the data are collected directly from the person concerned, to give that person, at collection or on transmission, the controller's identity, the purposes of the processing, the categories of data, the recipients or categories of recipients, whether answering is obligatory or optional and the consequences of not answering, the right to ask to no longer appear in the file, the rights of access and rectification, the retention period, and any transfer of the data abroad that is envisaged; article 17 exempts processing the State carries out for State security, national defence, public security, or the execution of criminal sentences, and processing necessary to prevent, investigate, establish, or prosecute an offence or to protect an important economic or financial interest of the State, to the extent the limitation is necessary.

Article 18 requires a controller to clearly and completely inform anyone using electronic communication networks of the purpose of any action to access or write information to their connection terminal equipment and of the means available to object to it, except where the access or writing is solely to enable the electronic communication or is strictly necessary to supply an online communication service the user expressly requested.

Article 19 gives every person the right to object, for legitimate reasons, to processing of data concerning them, the right to be informed before their data are first communicated to or used on behalf of third parties for prospecting purposes, and the right to be told, free of charge, of their right to object to that communication or use.