National Institute of Demographic Studies (INED) – Violation Found (France, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The National Institute of Demographic Studies (INED) planned a survey that would collect sensitive personal data to help understand work-life balance. The French data protection authority confirmed that the survey could proceed but emphasized that the data must be fully anonymized before sharing. This ruling highlights the importance of proper data handling in research projects.
What happened
INED sought approval for a survey that would process sensitive personal data related to health, sexuality, and religion.
Who was affected
Individuals whose sensitive personal data would be collected for the Families and Employers survey.
What the authority found
The French data protection authority ruled that processing sensitive data for public interest research is permissible, but the data must be anonymized before dissemination.
Why this matters
This decision underscores the need for researchers to handle sensitive data responsibly and ensure that data is anonymized before sharing. It sets a standard for future research projects involving sensitive information.
GDPR Articles Cited
National Law Articles
The National Institute of Demographic Studies (INED) (the controller) – intended to implement a “Families and Employers longitudinal survey project” (FamEmp), which would involve the processing of sensitive personal data of data subjects. The data controller founded the legal basis for the processing on public interest under Article 6(1)(e) GDPR. The survey was aimed at making available to the scientific community statistical survey data relating to the balance between professional, family and personal life to analyse the impact of these interrelations on life courses and factors of risks according to professional and family characteristics. The data controller requested an opinion from the the French DPA (CNIL) on 22 May 2023 regarding the FamEmp survey, as on the basis of Article 44(6) of [https://www.wipo.int/wipolex/en/text/514585 French law no. 78-17 of 6 January 1978] and Article 36 GDPR, any data controller has to obtain a published opinion of the DPA when seeking to process sensitive personal data for public research purposes. In support of this request, the data controller carried out an impact assessment relating to the envisaged processing. The CNIL issued its opinion as follows. On the legal basis for data processing, the DPA acknowledged that the survey involved the processing of sensitive data relating to the health, sexuality and religion of the data subjects and held that such processing for the FamEmp is legitimate and the processing permissible in law in the public interest. Secondly, the data controller stated that the survey results would be transmitted to third parties in pseudonymised form, to which the DPA replied that the data must be anonymised before being disseminated and not pseudonymised. It also reminded the controller that the disseminated data must be equally adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Thirdly, on the storage and retention period, the data controller
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for National Institute of Demographic Studies (INED) in FR
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
14 September 2023
Authority
Commission Nationale de l'Informatique et des Libertés
GDPRhub ID
gdprhub-6272About this data
Cite as: Cookie Fines. National Institute of Demographic Studies (INED) - France (2023). Retrieved from cookiefines.eu
Last updated: