Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

France: CNIL orders Ministry of the Interior to amend management of automated digital fingerprint database

The French data protection authority ('CNIL') published, on 30 September 2021, deliberation of its restricted committee No. SAN-2021-016 of 24 September 2021 concerning the Ministry of the Interior, whereby it sanctioned the Ministry for its management of the automated digital fingerprint database ('FAED'), the database containing fingerprints of persons accused in criminal proceedings. In particular, the decision outlines that the processing of personal data within FAED included violations pertaining to, among other things:

  • storing data beyond that which is legally required under Article 5 of the Decree of 8 April 1987 establishing the FAED ('the Decree'), in violation of Article 4 of the Law Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR')) ('the Act');
  • storing data relating to persons whose proceedings were acquitted, dismissed, or closed, in violation of Article 97 of the Act;
  • use of an insufficiently robust password, in violation of Article 99 of the Act; and
  • failure to respect the right to information of data subjects, in violation of Article 104 of the Act. 

Consequently, the decision orders the Ministry to comply with the following before 31 December 2021, among other things:

  • delete data collected beyond that which its required within the Decree;
  • deleting files with expired retention periods;
  • ensure that decisions regarding the acquittal or correction of proceedings are respected in the FAED;
  • ensure that decisions regarding closure or dismissals of proceedings are respected in the FAED only in the case of decisions taken by the public prosecutor;
  • reinforce FAED's network security; and
  • inform individuals whose fingerprints are entered into the FAED.

In addition, the decision orders the Ministry to delete files of a preceding analog database before 31 December 2022.

You can read the press release here and the deliberation here, both only available in French.