Status & Composition
An Independent Administrative Authority
Created in 1978, the CNIL is an independent administrative authority that exercises its functions with accordance to the French Data Protection Act of the 6th of January 1978, amended the 6th of August 2004.
The CNIL’s independence is guaranteed by its composition and its organization. The seventeen members that form the commission are for the most part elected by the assemblies and jurisdictions to which they belong. The CNIL elects its chairperson amongst its members and does not receive any instructions by any other authority to the election of the chair.
- 4 Parliamentarians (2 Assembly members, 2 Senators)
- 2 members of the French Economic, Social and Environmental Council
- 6 representatives of high jurisdictions (2 State Council members, 2 members of the Court of Cassation and 2 members of the Audit Court)
- 5 qualified public figures appointed by: the President of the National Assembly (1 public figure), the President of the Senate (1 public figure), the French Cabinet (3 public figures). The mandate of the commissioners is for 5 years, or, for parliamentarians, as long as the duration of their mandate.
Institutional Proceedings
Plenary Session
The members of the CNIL hold a plenary session once a week according to an agenda set by the Chair. A substantial part of these sessions is dedicated to the review of draft legislation and decrees submitted by the government for an official CNIL opinion.It analyses the consequences of new technologies on citizens’ private lives.
Restricted Committee
The CNIL’s restricted committee includes 5 members and a Chairman separate from the Chair of the CNIL. It can impose various sanctions on data controllers who do not comply with law. With the GDPR (General Data Protection Regulation), the amount of financial sanctions can reach up to €20 million, or for companies up to 4% of their global yearly turnover. These financial sanctions can be made public.
The CNIL's organization chart
