What Needs to be Done Prior to Collection

Contact the data subject

Contact the Data Protection Authority

Article 32

I. - The data controller or his representative must provide a data su bject from whom personal data is obtained with the following information, except where he already has it:

(1) the identity of the data controller and of his representative, if any;

(2) the purposes of the processing for which the data is intended;

(3) whether replies to the questions are compulsory or optional;

(4) the possible consequences for him of the absence of a reply;

(5) the recipients or categories of recipients of the data;

(6) the rights granted him by Section 2 of this Chapter (rights of individuals in relation to the processing of data);

(7) when applicable, the intended transfer of personal data to State that is not a Member State of the European Community.

If the data is obtained by way of a questionnaire, the information provided for in Sub-sections (1), (2), (3) and (6) shall be directly mentioned on this questionnaire.

II. - Any person who uses an electronic communication network shall be informed in a clear and complete manner by the data controller or his representative regarding:

- the purpose of any action intended to provide access, by means of an electronic transmission, to information stored in his connection terminal equipment, or to record information in his connection terminal equipment by the same means;

- the means he has to object to such action.

These provisions shall not apply if the access to information stored in the terminal equipment of the user or the recording of information in the terminal equipment of the user is-

- exclusively intended to allow or facilitate communication by electronic means; or

- strictly necessary for the provision of an online communication service at the user’s express request.

III. - Whenever the data have not been obtained from the data subject, the data controller or his representative must at the time of recording the personal data or, if disclosure to a third party is planned, no later than the time when the data is first disclosed, provide the data subject with the information enumerated in Section I.

When the personal data has initially been obtained for another purpose, the provisions of the preceding paragraph shall not apply to processing necessary for the storage of these data for historical, statistical and scientific purposes, under the conditions provided for in Book II of the “Code du Patrimoine” (Heritage Code) or for the re-use of this data for statistical purposes under the conditions provided for in Article 7a of Act No. 51-711 of 7 June 1951 on obligations, co-ordination and confidentiality as regards statistics. These provisions shall not apply whenever the data subject has already been informed or whenever informing the data subject proves impossible or would involve disproportionate efforts compared with the interest of the procedure.

IV. – If the personal data obtained are, within a short period of time, to form part of an anonymization procedure that was recognized beforehand by the “Commission nationale de l’informatique et des libertés” as complying with the provisions of this Act, the information delivered by the data controller to the data subject may be limited to that mentioned in Sub-section (1) and (2) of Section I.

V. – The provisions of Section I shall not apply to data obtained under the conditions provided for in Section III when processing is carried out on behalf of the State and relating to State security, defense, or public safety, to the extent that such limitation is necessary for the observance of the purposes pursued by the pro

cessing.

VI. – The provisions of this Article shall not apply to the processing of data in relation to the prevention, investigation or proof of criminal offences and the prosecution of offenders.

Contact the Data Protection Authority

Article 22

I. - Automatic processing of personal data must be notified to the “Commission nationale de l’informatique et des libertés” (CNIL)

Section 1: Notification

Article 23

I. - The notification shall comprise an undertaking that the processing complies with the requirements of the law.

It may be sent to the ”Commission nationale de l’informatique et des libertés” Commission nationale de l’informatique et des libertés electronically.

The commission shall deliver a receipt without delay and this may be delivered electronically.

The applicant may carry out the processing as soon as receipt is received. He shall not be exempted from any of his responsibilities.

Section 1: Obligations incumbent upon data controllers

Article 32

I. - The data controller or his representative must provide a data subject from whom personal data is obtained with the following information, except where he already has it:

(1) the identity of the data controller and of his representative, if any;

(2) the purposes of the processing for which the data is intended;

(3) whether replies to the questions are compulsory or optional;

(4) the possible consequences for him of the absence of a reply;

(5) the recipients or categories of recipients of the data;

(6) the rights granted him by Section 2 of this Chapter (rights of individuals in relation to the processing of data);

(7) when applicable, the intended transfer of personal data to State that is not a Member State of the European Community.