As a reminder, the CNIL or National Commission for Information Technology and Liberties is an independent French administrative authority responsible for ensuring that information technology does not harm citizens. For a website, it is compulsory in certain cases to declare to the CNIL its file for collecting information on its members, prospects or customers. Find out in the rest of this article the cases where it is compulsory to declare yourself and the procedure for registering with the CNIL …
In which case is it compulsory to declare your data file?
The cases being multiple, to know its obligations in terms of declaration to the CNIL, it is essential to use the exemption tool of the CNIL website. You only have to enter the type of activity you exercise and the tool will display the different related exemptions. If your activity is part of the exemptions, you do not have to declare yourself. If on the other hand, no exemption corresponds to you, you have the obligation to declare yourself.
As a reminder, the law requires that any processing of personal data be subject to prior formalities, under penalty of criminal sanctions: 5 years imprisonment and 300,000 euros fine. (Source: Personal Data.fr).
Here are some examples to illustrate the exemptions granted:
For an individual, files linked to a personal website or blog, to exclusively personal activities or to a journalism activity are not affected by the declaration to the CNIL. For a private company, files linked to suppliers or intended for non-commercial communication are not affected either.
The cases are quite diverse according to your legal form and your activity, use the tool mentioned above to know your obligations.
In the case of CWT Advertising & co’m which has become a business in recent months, the declaration is mandatory because the blog is no longer kept solely for personal use. In addition, certain files have been created for prospects and customers and therefore require a declaration to the CNIL. Generally, from the moment the files are created for commercial use (even in part), the declaration is necessary.
You are fixed on your obligations, now let’s see how to declare your file to the CNIL.
How to declare your file to the CNIL?
Note that since 2006, websites no longer have to be declared as such. It is the constitution of a file for the purpose of processing personal information which must be.
Depending on your case, you will be directed to the normal declaration or the simplified declaration. In most cases, the simplified declaration suffices, now let’s see the declaration steps.
A first form will ask you for information related to your company: Siren number, APE code, Address, etc.
You will then have to specify the nature of your file from the choices offered.
A third form will ask you to give the contact details of the person whom the CNIL may possibly contact.
The contact details of the person responsible for the reporting organization must also be entered.
And it’s already finished, nothing complicated, just validate the form and you will get your registration document indicating your declaration number. For normal reporting, some additional information will be requested but nothing nasty.
And now ?
Once you have obtained your CNIL declaration number, you must display it on your site. Most of the time, this number can be found on the “Legal notices” page. You can see our example here.
And you, does your activity require a declaration to the CNIL? Feel free to share your experiences via comments.
Sources and related articles:
- CNIL website
- Personal data.fr: CNIL Declaration
- CNIL: your responsibilities