A formal notice is not a sanction. It allows the company to regularise its situation and have the proceedings closed.
A formal notice generally sets compliance objectives without specifying the means of achieving them. The company must therefore determine the appropriate legal, technical and organisational measures and implement them within the time allowed.
How should this compliance work be organised, and how can sanction proceedings be avoided?
1. What is the scope of a CNIL formal notice?
A formal notice is a decision of the Chair of the CNIL requiring an organisation to remedy the breaches found during an inspection.
It specifies the measures expected and the time allowed. It may relate, in particular, to data collection practices, retention periods, data security or the exercise of data subjects’ rights.
Unlike sanction proceedings, a formal notice is not preceded by adversarial proceedings. The company therefore has no formal stage in which to discuss the breaches found or the measures required.
A formal notice may be made public by decision of the CNIL’s Bureau, which adds a reputational risk to the legal issues at stake.
2. How should the compliance measures be defined?
The main difficulty lies in translating the CNIL’s requirements into operational measures. A formal notice generally sets a result to be achieved, without detailing the technical or organisational solutions to be implemented. It is for the company to determine the measures suited to its processing operations and information systems.
This analysis requires an understanding of the breaches identified during the inspection and of the CNIL’s expectations. An inadequate interpretation of these requirements may lead to the adoption of unsuitable corrective measures.
The measures adopted must then be broken down into specific actions, with an implementation timetable. Depending on the breaches, their implementation may require the involvement of the legal, technical and business teams, as well as external service providers.
For example, remedying breaches relating to retention periods may involve changing application settings and erasure procedures, beyond simply updating internal policies.
3. What is the deadline for complying with a formal notice?
The compliance deadline is set in the formal notice decision. It runs from the date of receipt and may not, save in cases of urgency, be less than ten days.
Since 2022, this deadline is no longer capped at six months. Where the complexity of the case so justifies, it may also be extended once.
The company must therefore take the time allowed into account as soon as it defines the corrective measures, particularly where their implementation requires technical developments or the involvement of service providers.
4. How does the CNIL verify compliance?
The CNIL may ask the company to demonstrate its compliance, in particular by submitting a written response accompanied by supporting documents. It may also issue a formal notice without requiring a response or supporting documents.
The CNIL may also carry out a further inspection to verify that the measures adopted are effective. It expressly lists formal notices among the possible origins of its inspections.
In all cases, the company must be able to demonstrate that the corrective measures have actually been implemented, particularly from a technical and operational standpoint.
5. What are the possible outcomes of a formal notice?
Closure of the proceedings
Where the breaches have been remedied, the Chair of the CNIL may close the formal notice. If the formal notice was made public, its closure is also made public.
Initiation of sanction proceedings
If a further inspection reveals that the required measures have not been implemented within the time allowed, the Chair of the CNIL may initiate sanction proceedings.
A second inspection is not, however, mandatory. Sanction proceedings may also be initiated on the basis of the information already available to the CNIL, particularly where a written response was required.
The company is then exposed, in particular, to an administrative fine.
How Odoné supports companies served with a CNIL formal notice
Odoné assists companies in interpreting the CNIL’s requirements, defining the corrective measures and monitoring their implementation.
Our experience of inspections and sanction proceedings enables us to identify the authority’s expectations and to secure compliance choices, with a view to facilitating the closure of the proceedings.
