Data transfers, videosurveillance, health data, traceability, here are the four axes of the annual program of on site investigations of the CNIL announced by Yann Padova, Secretary General, at the round table organized by Privacy Laws & Business on April 6.

The CNIL carried out 310 on site investigations last year and 400 are announced for this year, 50% of which should be made on the basis of the CNIL annual program.

In recent years, the CNIL has increasingly expanded its international department and positioned itself within the European Union as a leading authority on the issue of BCR (Binding Corporate Rules). She has developed a specific guide in 2008 and last summer new fact sheets on data transfers outside the E.U. Henceforth, the CNIL intends to check whether its explanatory efforts are implemented by data controllers. It will therefore control companies based in France which transfer data abroad, but also companies located abroad which receive data from France. To this end, the CNIL is setting up cooperation agreements with foreign authorities.

As soon as the annual program adopted by the CNIL in plenary session on March 31, the agents of the CNIL have immediately begun on site investigations of videosurveillance systems in public areas, making use of the new powers of the CNIL granted by the LOPPSI II (Law on international security).

The targeted sector of activity this year is healthcare. All stakeholders are impacted, insurers, hosts, healthcare professionals... The CNIL is pursuing an objective: ensuring the security of data throughout all the data processing chain.

Finally, regarding the Web, the issue on which CNIL agents will focus is traceability,  « what anonymity for end users ? » which is likely to lead them to study social networks, profiling practices, cookies and web beacons.