CNIL (Commission nationale de l'informatique et des libertés)

What is the CNIL?

The CNIL was created by the Loi Informatique et Libertés of 6 January 1978, a decade before most countries had any data protection law. It is an independent administrative authority with a college of commissioners, a restricted committee that decides sanctions, and powers to investigate, order compliance and fine up to 4 percent of worldwide turnover under the GDPR.

What has it done about face search?

In CNIL v Clearview the authority found that Clearview AI had no lawful basis for collecting and processing the faces of people in France, that it had ignored access and erasure requests, and that it had failed to cooperate. It ordered Clearview to stop and delete the data in December 2021, fined it 20 million euros in October 2022, and imposed a further 5.2 million euro overdue penalty in May 2023 when Clearview did not show compliance. Clearview did not pay or appeal in France; the decision is a reference point for every European action against scraped face indexes.

The CNIL has also set out its position on facial recognition more broadly: a 2019 report on the technology's risks, opinions against facial recognition at school gates (2019) and in the 2024 Olympic security law debate, and guidance that a face template is biometric data requiring an Article 9 condition.

1. 1978-01-06

   CNIL created

   By the Loi Informatique et Libertés.

2. 2019-11-15

   Facial recognition position paper

   The CNIL sets out conditions for any deployment and calls for public debate.

3. 2021-12-16

   Formal notice to Clearview AI

   Order to stop collecting French residents' faces and to delete the data.

4. 2022-10-17

   20 million euro fine

   Maximum fine under the GDPR for the processing and the failure to cooperate.

5. 2023-05-10

   5.2 million euro overdue penalty

   For failing to prove compliance with the 2022 order.

How do you use the CNIL?

• Complaint: online form on cnil.fr (in French), after contacting the organisation first. The CNIL can investigate and sanction but does not award damages.
• Right of access and erasure: the CNIL publishes model letters for asking any company, including a face search engine, what it holds and to delete it.
• Cross-border cases: complaints about engines based elsewhere in the EEA are routed to the lead authority through the EDPB one-stop-shop; engines based outside the EEA can be handled directly, as Clearview was.