The French data protection authority (CNIL) published two new practical fact sheets designed to help actors developing AI systems to comply with the GDPR. The CNIL shares its recommendations on the use of legitimate interest as a legal basis for the development of AI systems and focuses on the collection of data through web scraping.  

The Commission Nationale de l’Informatique et des Libertés (CNIL), the French data protection authority, recently published two recommendations to support innovation in the field of artificial intelligence (AI) in accordance with the General Data Protection Regulation (GDPR). It adopts a didactic approach, issuing recommendations, best practice and explanations on how to apply the principles of the GDPR in the context of AI.

On June 10th, 2024, the French Data Protection Authority (CNIL) began a publication consultation on a second series of seven practical information sheets seeking to provide legal certainty for developers of AI systems by anticipating the relationship between the EU AI Act and the GDPR.

On May 16th, 2023, the French data control agency – Commission Nationale de l’Informatique et des Libertés (CNIL) – published an action plan aimed at ensuring respect for the privacy of people in relation to Artificial Intelligence (AI) systems and more specifically generative AI (e.g. Midjourney and ChatGPT from the company OpenAI). This action plan follows the 2017 CNIL’s first global approach on these new tools.  

The ‘Commission Nationale de l’Informatique et des Libertés’ (CNIL – the French DPA) released its final decision on October 20th, 2022, sanctioning Clearview AI for its unlawful activity, which consists of collecting images of millions of individuals from the open web without any legal basis under the GDPR for doing so. 

On September 24th, 2022, the French NGO ‘La Quadrature du Net’ challenged the use of technology-driven tools by French police forces before the Commission Nationale de l’Informatique et des Libertés (CNIL – French DPA). By means of three separate complaints, the NGO wants to raise awareness about what it calls the ‘technopolice’, which amounts to the police using methods that may pose risks to privacy. These complaints follow a petition published by LQDN which collected 15 248 signatures.

Due to the proliferation of “intelligent” video devices in public spaces, the French Data Protection Authority (CNIL) launched a public consultation on its draft position concerning the conditions for the deployment of so-called “smart” cameras in public spaces. Following several months of consideration, and various contributions from public and private actors, the Commission published its opinion last July.

On May 27, 2021, a coalition of civil society groups including Privacy International, the Hermes Center for Transparency and Digital Human Rights, Homo Digitalis and noyb, filed several claims in Europe against the U.S facial recognition firm Clearview AI.

The French government issued a decree on March 10, 2021 authorising automated analysis of the rate of compliance with the obligation to wear a mask on public transport

On Thursday 18, 2020, the President of the CNIL issued a warning to a sports club who were considering using a facial recognition system to stop people with stadium bans from attending their games.

A very important White Paper on Internal Security, published on November 16, 2020, by the French Ministry of the Interior, makes several proposals for the use of Facial Recognition Technology (FRT) by public authorities in France.

On October 9, 2020, the CNIL (French Data Protection Authority) clarified its position on the use of facial recognition technology at airports, providing useful guidance for French airports’ managers and service providers in their experimentation of FRTs.