CNIL priority topics for investigations in 2024

On the 8th of February 2024, the French Data Protection Authority, the CNIL, announced the following priority topics for 2024: 

Data collection for the Olympic and Paralympic Games: As millions of individuals are due to travel to France for the Olympic and Paralympic Games this year, major security measures are being deployed. The CNIL will therefore prioritise the verification of measures implemented for security purposes (such as the use of QR codes for restricted areas, access authorisations, and the use of augmented cameras) and their impact on individuals’ privacy. Additionally, the CNIL will address commercial aspects of the Olympic Games, and the collection of data within the context of the ticketing services in order to ensure compliance with current legal framework.

Data collected online from minors: With the exponential increasing presence of minors online, their exposure to social networking sites, dating platforms, and online gaming platforms has heightened, resulting in the gathering of personal data concerning their identity, preferences, and lifestyle. The collection of this data carries substantial repercussions for their privacy, psychological well-being and socio-professional future. The CNIL will consequently investigate whether popular online platforms among children and teenagers :

• have implemented age control mechanisms, 
• respect the data minimisation principle 
• have introduced sufficient security measures to protect minors' data. 

Loyalty programmes and electronic till receipts: Many supermarket chains offer loyalty programmes, entailing the collection of large amounts of consumer personal data. This collected data is often re-used for advertising and targeting purposes. Additionally, the increasing prevalent use of digital receipts may result in further processing of personal data, such as facilitating receipt delivery via SMS or email. Consequently, the CNIL will afford special attention to the information shared with consumers and ensure that consent is obtained before data is re-used for advertising targeting purposes.

Data subjects' right of access: Participating in the third action of the Coordinated Enforcement Framework of the European Data Protection, the CNIL will conduct checks on the conditions under which data controllers implement the right of access. The objective of this initiative is to ensure the consistent enforcement of the GDPR and enhance cooperation among supervisory authorities.