Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, droits de la personne concernée

Article 58 requires a controller collecting data directly from the person to tell them, at the latest when collecting it, who is responsible for the processing, its purpose, the categories of data, the recipients, whether a reply is mandatory or optional and the consequences of not replying, their right to be removed from the file, their access and rectification rights, the retention period, and any transfer abroad.

Article 59 requires that same information to be given, when data is not collected from the person, at the time it is recorded or, if disclosure is planned, no later than the first disclosure, while article 60 exempts data used for state security, defence, public security, criminal enforcement, or an important economic or financial interest of the State.

Article 61 requires a controller accessing or writing information on a user's terminal equipment by electronic transmission to tell the user its purpose and how to object, unless the access only enables the communication or is strictly necessary for a service the user expressly requested.

Articles 62 and 63 give a person a written right to access their data, its origin and purpose, and a copy on payment of no more than the reproduction cost, and article 64 lets them refer a suspected mismatch between the data disclosed and the data actually processed to the CDP for verification.

Article 65 lets a patient's access right be exercised through a physician they designate, article 66 lets a controller resist manifestly abusive requests while carrying the burden of proving abuse, and article 67 routes access to a state security, defence or public security processing through a CDP member who investigates and decides what can be disclosed.

Article 68 gives a person the right to object, for legitimate reasons, to processing of their data, to be told before their data is first disclosed to or used by a third party for prospecting, and to object to that disclosure or use free of charge, and article 47 separately bars sending a person direct marketing communications by any means before they have expressed prior consent to receive them.

Article 69 lets a person demand that inaccurate, incomplete, ambiguous, outdated, or unlawfully processed data about them be corrected, completed, updated, blocked, or deleted, requires the controller to prove compliance within one month at no cost, and requires the controller to notify any third party the data was disclosed to.

Article 48 bars a judicial decision assessing a person's conduct from resting on automated processing that evaluates aspects of their personality, and bars any decision producing legal effects from resting solely on automated profiling, except a contractual decision where the person could make observations or a decision granting their own request.