The municipality of Saint-Dizier, in Haute-Marne, was put on notice like twenty French cities by the National Commission for IT and Liberties (CNIL) because of the absence within it of a delegate for the protection of personal data. .
When we talk about personal data, we may think more easily of targeted marketing or health data. But this also concerns information kept by local authorities.
And rGeneral Data Protection Regulation (GDPR) provides several mechanisms to protect the personal data of citizens. This notably involves the mandatory appointment of a Data Protection Officer (DPO) in each community, regardless of its size.
The DPO is a well-identified person within a community who is entrusted with several missions related to personal data. In particular, it must “inform and advise the community”, “monitor compliance with regulations and national law on data protection” and “be the point of contact for the people whose data is processed and the privileged interlocutor of the CNIL”as can be read in a practical sheet published by the Commission Nationale Informatique et Libertés.
The CNIL has begun to monitor the correct application of the law, targeting more particularly municipalities with more than 20,000 inhabitants. In June 2021, she sent a letter to those who did not yet have a DPO.
A year later, it decided to issue public notice to 22 municipalities that had not responded to its requests, as she announced in a press release issued on May 31.
We find in the list of cities like Beaune (Côte-d’Or), Bastia (Haute-Corse) or Saint-Dizier. We contacted the town hall of the most populous municipality in Haute-Marne this Thursday, June 2. She confirms that she does not currently have a personal data protection officer.
A person had been designated to occupy this function but she is part-time on maternity leave, we are told. A call for applications was recently launched internally to appoint a new DPO.
The situation could therefore return to normal in the coming months. In any case, the municipalities given formal notice by the CNIL have four months to comply.
If at the end of this period, they have not returned to the ranks, the CNIL “may decide on a fine and also make it public”indicates the independent administrative authority in its press release.
In alphabetical order: Achères (78), Auch (32), Bastia (2B), Beaune (21), Bezons (95), Bruay-la-Buissière (62), Étampes (91), Gagny (93), Koungou ( 976), Kourou (973), Le Gosier (971), Le Robert (972), Montmorency (95), Montfermeil (93), Petit-bourg (971), Pierrefitte-sur-Seine (93), Saint-André ( 974), Saint-Benoît (974), Saint-Dizier (52), Sotteville-lès-Rouen (76), Villeneuve-Saint-Georges (94) and Vitry-sur-Seine (94).
–
