Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

France: CNIL publishes recommendations on use of public data and open data distributors

On June 12, 2024, the French data protection authority (CNIL) published its recommendations on the use of public data and distributors of open data.

In particular, CNIL highlighted that the recommendations together should help organizations:

  • identify the responsibilities of different organizations;
  • determine the lawfulness of processing;
  • know the scope of their obligations in terms of informing individuals concerned;
  • take into account people's rights; and
  • guarantee the relevance and proportionality of data processed, its accuracy, and security.

CNIL clarified that the recommendation on the reuse of company data is still subject to consultation.

Recommendation on the use of public data

The recommendation on using public data applies to organizations that want to use publicly available personal data for purposes such as commercial prospecting or scientific research. CNIL distinguished the use of publicly available data into four use cases:

  • disseminating professional directories;
  • creating and enriching bases intended for commercial prospecting;
  • scientific research, excluding health; and
  • use by public authorities.

The recommendation for using public data outlines that organizations must first determine their legal status under the General Data Protection Regulation (GDPR) before processing public personal data. The recommendation on using public data also outlines how to identify the legal basis for processing, how to inform data subjects, what data subject rights apply to publicly available data, and how to guarantee the minimization of processed data.

In addition, CNIL outlined that organizations can generally rely on the legal basis of legitimate interest when reusing data disseminated by administrators under public data legislation. In terms of informing data subjects, organizations may carry out public and non-individual communications where an email address is not available.

Regarding professional directories, organizations must provide the opportunity for affected professionals to not appear in the directory or leave. For commercial prospecting, organizations that do not have prior consent will only be able to collect their personal data if they can reasonably expect it. 

Recommendation on distributors of public data

The recommendation on public data distributors applies to organizations that make personal data available to the public, such that the data is open, easily reusable, and in a machine-usable format. The recommendation on public data also provides information on identifying, among other things, the legal status of data distributors under the GDPR, the correct legal basis for processing, and how to inform affected persons.

You can read the press release here, the recommendation on using public data here, and the recommendation of public data distributors here, all only available in French.