Steps to follow when the CNIL requests explanations on the processing of personal data: risks and recommendations

When a company receives a letter from the French Data Protection Authority (CNIL) requesting explanations about its personal data processing practices, it is faced with a delicate situation that requires a rapid, rigorous response that complies with the requirements of the General Data Protection Regulation (GDPR). Indeed, an inadequate response can lead to serious consequences, including administrative penalties of up to €20 million or €4.1 billion of annual global turnover (Article 83 of the GDPR). This article examines the steps to take when faced with such a letter, the risks involved, the opportunity to submit a Data Protection Impact Assessment (DPIA), as well as the three key elements to provide in the response to avoid litigation.

1. Steps to follow in response to a letter from the CNIL

The CNIL, as the supervisory authority responsible for ensuring compliance with data protection laws, can send a letter to companies to obtain information on the processing of personal data that they carry out. This letter may have different motivations: a complaint from an individual, a scheduled inspection, or a verification linked to a report. Whatever the reasons, it is essential to treat the request seriously and quickly.

a. Carefully analyze the contents of the mail

The first step is to carefully read the application for the CNILThe letter may request specific information on certain data processing, the justification of their legal basis, the security measures implemented, or even details on the internal procedures allowing the exercise of rights of the persons concerned. It is crucial to understand what is expected, the response times indicated, and the documents to be provided.

b. Prepare a complete file to respond to the request

After identifying the requested information, a complete and documented file should be put together. This file must include in particular:

• The data processing register (Article 30 of the GDPR): this document lists the processing carried out by the company, the purposes of this processing, the categories of data processed, the legal bases used, and any subcontractors involved.
• Internal data protection policies : they demonstrate that the company has implemented organizational measures to comply with data protection principles (minimization, limitation of conservation, security, etc.).
• The technical and organizational measures adopted to ensure data security, in accordance with Article 32 of the GDPR, such as encryption, pseudonymization, access control, and security incident management procedures.

c. Consult the Data Protection Officer (DPO)

If the company has appointed a Data Protection Officer (DPO), it is imperative to involve him/her in the process of responding to the CNIL. The DPO plays a key role in

assistance with the organization's compliance and in managing relations with the supervisory authority. Its mission includes supervising data processing, raising employee awareness, and advising on responses to requests from the authorities. Its consultation is therefore a guarantee of good faith and diligence in the context of dialogue with the CNIL.

2. Risks in the event of non-compliance or insufficient response

An inadequate response or lack of response to a request for explanations from the CNIL can lead to various risks for the company, ranging from financial penalties to restrictions on data processing.

a. Risk of administrative sanctions

Article 83 of the GDPR provides for administrative fines proportionate to the seriousness of the violation. Breaches of basic data protection principles, data subject rights, or security obligations can result in fines of up to €20 million or €4 billion of the company’s worldwide annual turnover, whichever is higher.

b. Risk of formal notice or injunction to comply

If the CNIL considers that the data processing does not comply with the requirements of the GDPR, it can send the company a formal notice to comply within a specific time limit. In the absence of regularization, the authority may take coercive measures such as an injunction to cease processing or to limit its purposes.

c. Suspension of data processing

In the most serious cases, the CNIL can order the temporary or permanent suspension of processing activities, which can significantly affect the company's activity. For example, an e-commerce company could be prevented from using its customer databases, which would directly harm its turnover.

3. Submitting an AIPD: when and why?

The AIPD (Data Protection Impact Analysis) is an assessment of the risks for rights and freedoms of persons concerned by processing of data. It is required when the processing presents a high risk, in particular in the following cases:

• Large-scale profiling ;
• Systematic surveillance of an area accessible to the public ;
• Processing of special categories of data on a large scale (sensitive data, health data, etc.).

If the AIPD has been carried out for the processing concerned, it is recommended to send it to the CNIL in response to the letter. This makes it possible to demonstrate that the company has assessed the risks upstream and put in place appropriate measures to mitigate them (articles 35 and 36 of the GDPR). If no AIPD has been carried out, it is necessary to justify why the processing did not present a high risk justifying such an analysis.

4. The three essential elements to provide in the response to avoid litigation

An adequate response to the CNIL must include specific information to demonstrate the company's compliance and avoid escalation to litigation. Here are the three key elements to provide:

a. Describe the compliance measures implemented

It is essential to demonstrate that the company complies with the basic principles of the GDPR (Article 5), including lawfulness, transparency, purpose limitation, and data minimization. This includes:

• Justification of the legal bases on which the processing is based (Article 6 of the GDPR).
• Providing information to data subjects on the processing of their data, including their rights of access, rectification, opposition, and erasure (articles 12 to 22 of the GDPR).

b. Explain the security measures adopted to protect data

Article 32 of the GDPR requires companies to implement appropriate security measures based on the risks associated with the processing. In the response to the CNIL, it is appropriate to:

• Detail the technical and organizational measures such as access control, data encryption, and incident management procedures.
• Justify security choices in connection with the AIPD, if it has been carried out, or with the risk assessment.

c. Transmit the AIPD or justify its absence

If the processing involves high risks, providing a DPIA can demonstrate that the company has taken the necessary precautions. In cases where a DPIA was not required, it is essential to explain the reasons why the processing did not present sufficient risks to require such an analysis (Articles 35 and 36).

In short, the response to a letter from the CNIL must be prepared with the greatest care, providing precise and justified information to demonstrate the company's compliance. Transparency approaches, collaboration with the DPO, and complete documentation of the measures implemented are essential elements to reduce the risk of sanctions and strengthen trust with the supervisory authority.

A well-reasoned response, supported by relevant documents, may be enough to convince the CNIL of the company's good faith and avoid costly litigation.