Loi n° 2013-015, the Autorité, supervision, and sanctions

Article 20 creates the Autorité de Protection des Données à Caractère Personnel (APDP) as an independent administrative authority, and articles 21 through 52 set its fifteen-member composition, its bureau, its sessions, and the resources the State must give it.

Article 31 charges the Autorité with setting the norms and purposes for collecting, processing, or retaining personal data, authorizing interconnections and transfers, informing and advising data subjects and controllers of their rights and duties, receiving complaints, carrying out the checks necessary for lawful processing, imposing administrative sanctions for a controller's breach of its obligations, referring to the Procureur de la République without delay any offence involving fraudulent manipulation of personal data that comes to its knowledge, keeping the public register of processing operations, and advising on any bill or decree touching personal-data protection.

Article 34 lets the Autorité receive and investigate complaints and decide on information or on-site inspection missions, and article 37 bars anyone from opposing the Autorité's action and requires them to take every measure useful to facilitate its work. Article 56 lets the Autorité's President refer any user in breach of the Act to the Procureur de la République, or file a complaint before the competent courts, for the criminal sanctions the law in force provides.

Article 61 lists the administrative sanctions the Autorité may impose: a warning to a controller acting in good faith who failed to observe administrative formalities, a formal notice to a controller at fault to bring it into compliance, an order to cease processing activities, and withdrawal of a controller's approval where the Autorité finds it necessary; article 62 lets the Autorité use any technical means at its disposal to enforce its decision, article 63 requires an administrative sanction decision to be reasoned on pain of nullity and notified to the party concerned, and article 67 lets the Autorité settle any pecuniary sanction with the offender at the offender's request, within the scales the law fixes.

Article 60 leaves civil action to the conditions the Code de Procédure Civile, Commerciale et Sociale and the Régime Général des Obligations set. Article 64 states that, besides the pecuniary sanctions of articles 65 to 67, custodial criminal sanctions also apply to these offences, and article 58 refers the classification of offences and applicable penalties to the Penal Code.

Article 65 fines the most serious violations, including unauthorized disclosure of or access to personal data affecting fundamental rights, individual freedoms, or privacy, purpose diversion, fraudulent collection, unauthorized health-research processing, unlawfully retaining offence or conviction data, and obstructing the Autorité's investigations, five million to twenty million CFA francs, and article 66 fines security-safeguard failures and storing racial, ethnic, or political, philosophical, religious, or union opinion data without the person's prior consent two million five hundred thousand to ten million CFA francs.