Loi n° 2017-020, droits de la personne concernée

Article 50 requires a controller collecting data directly from the person to tell them, at the latest when collecting it, who is responsible for the processing, its purpose, the categories of data, the recipients, whether a reply is mandatory or optional and the consequences of not replying, their access, rectification and objection rights, the retention period, any transfer abroad, and their right to be removed from the file, subject to exemptions for state security, defence, public security, criminal enforcement, and major economic or financial interests of the State.

Article 51 requires that same information to be given, when data is not collected from the person, at the time it is recorded or, if disclosure is planned, no later than the first disclosure.

Article 52 requires a controller accessing or writing information on a user's terminal equipment to tell the user its purpose and how to object, bars conditioning access to a service on accepting that processing, unless the access only enables the communication or is strictly necessary for a service the user expressly requested.

Articles 53 and 54 give a person a written right to access their data in an accessible and intelligible form, its origin, and a copy on payment of no more than the reproduction cost, and article 55 lets them refer a suspected mismatch between the data disclosed and the data actually processed to the Authority for verification.

Article 56 lets a patient's access right be exercised through a physician they designate, article 57 lets a controller resist manifestly abusive requests while carrying the burden of proving abuse, and article 58 routes access to a state security, defence or public security processing through an Authority member who investigates and decides what can be disclosed.

Article 59 gives a person the right to object, without cost, to processing of their data, to be told before their data is first disclosed to or used by a third party for prospecting, and to object to that disclosure or use free of charge, unless the processing meets a legal obligation, and article 60 gives a right to object to the lifting of professional secrecy concerning them, subject to the legal exceptions, while article 18 separately bars sending a person direct marketing communications by any means before they have expressed prior consent to receive them.

Articles 61 through 63 let a person demand that inaccurate, incomplete, ambiguous, outdated, or unlawfully processed data about them be corrected, completed, updated, blocked, or deleted, require the controller to prove compliance within one month at no cost and to notify any third party the data was disclosed to, and let an heir make the same demand to reflect the person's death.

Article 19 bars a judicial decision assessing a person's conduct from resting on automated processing that evaluates aspects of their personality, and bars any decision producing legal effects from resting solely on automated profiling.