At the end of April, the French data protection authority (CNIL) released its inspection schedule for 2014 (the Schedule), promising to carry out some 550 inspections over the course of the year.

Approximately 350 inspections are expected to be on-site, a quarter of which will focus on CCTV/video surveillance, and 200 will be carried out using the CNIL’s new powers of online investigation. These powers, introduced in April 2014, enable agents to carry out “remote investigations” into compliance with the French Data Protection Act.

The Schedule sets out six priority areas for inspections in the period, including:

  • Processing personal data by the National Database on Household Credit Repayments
  • Handling data security breaches by electronic communications operators
  • Collecting and using personal data, including sensitive data, by social networks, online dating providers and third-party applications linked to social networks
  • Processing personal data by the government’s system for the payment and collection of income tax
  • Processing personal data by online payment systems
  • Processing personal data by the National Sex Offenders Register

The CNIL will also continue to participate in the Article 29 Working Party’s effort to harmonise the approach of EU data protection authorities regarding Internet cookie compliance.

The CNIL further renewed its commitment to support international cooperation between data protection authorities, and is set to take part in the 2nd Global Privacy Enforcement Network’s Internet Sweep (Internet audits evaluating how well websites protect the data privacy of their users).

International cooperation is a hot topic for EU data protection authorities. In anticipation of the General Data Protection Regulation and its proposed introduction of a “one-stop shop” mechanism, regulators across Europe will be looking to plan ahead for the changes to come. The CNIL has also, on behalf of the Article 29 Working Party, been leading the EU data protection enforcement against Google after the implementation of its new platform (also covered by this blog here [dated Jan. 21, 2014]).