Cybersecurity Policy Report, CNIL Releases GDPR Guide Aimed at Public Affairs Officials, (Mar 13, 2024)
By Tony Foley
Working in coordination with associations representing business and public relations professionals, the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), has published a guide to help professionals in the public affairs sector to comply with the European Union’s General Data Protection Regulation (GDPR).
According to a news release announcing the publication, CNIL said public affairs officials, as part of their activities, collect personal data related to individuals and that such data must be processed in accordance with GDPR requirements. Several associations, including the French Association of Lobbying and Public Affairs Consultants, the Association of Public Affairs Professionals, the Association of Lawyers-Conseils in Public Affairs, and the Syndicat du Public relations consultancy, requested support from CNIL in December 2021 to enable the application of the GDPR data collection and processing by such officials.
The guide, which may be accessed from the news release but is available only in French, is designed to provide legal certainty for public affairs professionals in their daily activities and to enable them to take concrete actions to ensure the protection of the personal data they use. Specifically, the guide will help these professionals do the following:
Understand who the relevant stakeholders are on a given subject through the use of a map identifying the government, administrative, associative, parliamentary, and media actors who are part of the concerned entity’s environment;
Act with identified stakeholders during the development of the mapping; and
Maintain relationships via the use of an “address book” or “intelligence capital” in the different structures’ areas of expertise.
In addition, the guide, which only covers data processing specific to public affairs, aims to support public affairs professionals to understand the GDPR’s key principles, including legal qualifications of the actors, legal bases and conditions for processing special categories of data, the types of information and the conditions under which they may waive the obligation to individually inform data subjects, and data retention periods.
News: InternationalLegislation DataPrivacy DataSecurity GDPR