A “Deliberation” of the CNIL (French Data Protection Authority) published in the February 16, 2011 Official Journal of the Republic of France as “Deliberation No. 2011-023” should ease the burden on companies that have no operations in France, and engage France-based subcontractors (or cloud service providers) in order to process their data on the French territory. This is the case, for example for US based companies that hire French service providers to process their payroll or manage databases of client information, where the concerned individuals (employees or customers) are located outside of France. Under the Deliberation certain categories of data will be exempt from the requirement to request an authorization. The exemption applies specifically to three categories of activities: (i) processing of payroll; (ii) management of workforce; and (iii) management of database of clients and prospects. The exemption is very narrow and very limited. Only the requirement for declaration or request for authorization is lifted. The remainder of the obligations remains. In particular, the Declaration stresses that there must be a written agreement between the foreign data controller and the French based data processor to ensure security and confidentiality of the data, and require the processor not to use data other than as requested by the data controller.
Read more
