French CNIL Declaration — Sensitive Data Processing (GDPR)

GDPR Article 9 identifies eight special categories: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and trade union membership; genetic data; biometric data processed for unique identification; health data; and data concerning a person's sex life or sexual orientation. Data on criminal offences and convictions is governed separately under GDPR Article 10 and specific provisions of the amended Loi Informatique et Libertés. Any organisation processing Article 9 categories must document the applicable legal basis from the ten exceptions listed in Article 9.2 GDPR — explicit consent, legal obligation, and public interest being the most common.

Yes. GDPR Article 35.3(b) requires a DPIA for any large-scale processing of Article 9 data. The CNIL published a list of operations that always require a DPIA (Deliberation n° 2018-327 of 11 October 2018). Even below the large-scale threshold, a DPIA is required whenever processing presents a high risk to individuals' rights and freedoms. The DPIA must be documented in writing and cover: a description of the processing, an assessment of necessity and proportionality, a risk evaluation, and the planned mitigation measures.

When the DPIA concludes that residual risk is too high for the data controller to mitigate alone, GDPR Article 36 requires a prior consultation with the CNIL before processing begins. The CNIL has 8 weeks from receipt of a complete file to issue a written opinion. This period may be extended by a further 6 weeks — 14 weeks in total — for complex cases; the CNIL must notify the data controller within the first month. No sensitive data processing may start while the consultation is pending.

The data controller — typically the chief executive or a designated DPO (Délégué à la Protection des Données, the French-law term for Data Protection Officer) — is legally accountable under GDPR Article 5.2. Where large-scale sensitive data processing makes DPO appointment mandatory (GDPR Article 37.1(c)), the DPO must be notified to the CNIL and consulted during the DPIA per Article 35.2. Where a DPO is not compulsory, the data controller may conduct the DPIA in-house or engage an external specialist, but retains final legal responsibility.

Penalties operate on two tracks. Administratively, GDPR Article 83.5 allows the CNIL to impose fines up to €20 million or 4% of global annual turnover — whichever is higher. In 2024 the CNIL issued several fines exceeding €3 million for unlawful processing of health data. Criminally, Article 226-19 of the French Penal Code (Code pénal) punishes collection of sensitive data without a legal basis with up to 5 years' imprisonment and a €300,000 fine.

Yes, without exception. GDPR Article 30.5 exempts organisations with fewer than 250 persons employed from the records obligation — unless the processing risks harm to individuals' rights and freedoms, is non-occasional, or involves Article 9 special-category data. The moment a small business processes sensitive data — even sporadically — a detailed record covering purposes, legal basis, retention periods, recipients, and security measures is mandatory. Failing to maintain it risks fines up to €10 million under GDPR Article 83.4.