Let’s review some figures from the CNIL: the number of inspections and sanctions carried out by the CNIL in the last 5 years, the period since the adoption of the GDPR.
The Commission Nationale de l’Informatique et des Libertés (CNIL) can control files that record personal data. This control can be exercised:
This graph represents the evolution of all CNIL controls over the last 5 years. It can be seen that the arrival of the General Data Protection Regulation in May 2018 has led to an increase in CNIL controls.
Reminder: the GDPR is the reference text on the protection of European citizens’ data.
Since its entry into force, companies that process personal data have been required to be compliant*, to raise awareness among their teams and to demonstrate their accountability**. The aim is to comply with the GDPR but also to maintain their level of compliance in the long term.
*Compliance: to comply with the General Data Protection Regulation.
**Accountability refers to the obligation of companies to implement internal mechanisms and procedures, technical and organisational measures to demonstrate that processing operations are carried out in accordance with this Regulation. These measures represent compliance with data protection rules.
The two explanations are undoubtedly complementary insofar as the entry into force of the GDPR seeks to evaluate data controllers and tightens the CNIL’s control rules.
Any type of organisation can be monitored by the CNIL and can be subject to a sanction in case of non-compliance with the GDPR. Indeed, they can be large groups such as Google, Amazon and Carrefour, or smaller companies such as SMEs or private doctors.
Do you process personal data? You must comply with the GDPR! The CNIL can control you and sanction you if you are not in compliance.
Example of personal data processing:
