Privacy Law in France: CNIL, Cameras and Your Rights

Privacy in France is not governed by a single law or a single institution. Two systems run in parallel, and most real disputes touch both. The first is data protection: the Reglement general sur la protection des donnees (RGPD) and the Loi Informatique et Libertes, supervised by an independent regulator, the Commission nationale de l'informatique et des libertes (CNIL). The second is the older protection of private life, enforced by the ordinary courts through the Code civil and the Code penal.

That split matters more than it sounds. It decides who you complain to, what you can realistically get, and how long it takes. A regulator can force an organisation to change its behaviour and can fine it. Only a court can order it to pay you. Readers who arrive expecting one process to deliver both outcomes are usually disappointed, and the fix is almost always to run the right process for the outcome you actually want.

Information last verified on 20 July 2026. This page presents general legal information, not legal advice.

The CNIL: What the Regulator Does and What It Cannot Do

The CNIL is the entry point most people use, and for good reason. Filing a complaint is free, whether you submit it online through the CNIL's complaint service at cnil.fr or send it by post to the Service des Plaintes in Paris. No filing fee stands between an ordinary resident and a formal look at what an organisation has done with their data.

What the CNIL can do at the end of that look is a graduated toolkit rather than a single lever. It ranges from a simple reminder or a formal notice (mise en demeure) up to administrative fines, capped at 10 million EUR or 2 percent of worldwide turnover for less severe breaches, and 20 million EUR or 4 percent for the most severe. A separate, faster simplified procedure exists for less complex files. It is capped at a 20,000 EUR fine, and those decisions are never made public or attributed to a named organisation.

What the CNIL cannot do is pay you. Its fines are paid to the State, not to the complainant. This is the single most common misunderstanding about the French system, and it shapes everything downstream: if your goal is compensation for a loss you can actually evidence, the CNIL route will not get you there on its own. How to File a CNIL Complaint in France (What It Can and Cannot Do) walks through the practical mechanics, including the point that the CNIL strongly recommends contacting the organisation first and describing that prior contact, and its outcome, in the complaint form itself.

Timing is worth setting expectations on too. The CNIL commits to giving a complainant a status update within about three months. Read that for what it is: a service commitment to keep you informed, not a legal deadline by which the file must be closed. And the process is not one-way. A sanction or a formal notice issued by the CNIL can be appealed to the Conseil d'Etat within two months of notification, extended to four months for organisations located outside France.

Cameras: Two Regimes, Not One

Cameras generate more privacy questions in France than any other single subject, and the reason so much of the online advice contradicts itself is that people apply one set of rules to two legally distinct situations.

French law splits camera rules by what is being filmed. Videoprotection covers cameras filming the public street or places open to the public, and it requires prefectural authorisation. Videosurveillance covers cameras filming spaces that are not open to the public, such as a private home or a business stockroom, and it sits under data protection rules instead. Get the category wrong and every downstream answer, about authorisation, signage, and retention, comes out wrong as well.

Retention is a good illustration. One month is a hard statutory ceiling only for authorised videoprotection of public space, under Code de la securite interieure article L.252-5. For workplace or private videosurveillance, the CNIL treats one month as a stated principle rather than a statutory cap, and in practice a few days of footage is often all that can be justified. Video Surveillance Laws in France: Cameras at Home, Between Neighbours, and at Work sets out both regimes side by side.

Home Cameras and Neighbour Disputes

A camera limited to the strictly private sphere, filming only inside your own home, garden, or driveway for household use, falls outside data protection law altogether. That carve-out is real, but it is narrow, and it is where most neighbour disputes begin. It stops the moment the camera also reaches a neighbour's property or the public way.

The CNIL is explicit on both halves of that limit. A private individual may not film the public highway, even to protect a car parked directly outside their own home, and may not film a neighbour's garden, pool, windows, or entrance.

The second trap is assuming that falling outside data protection law means falling outside law. It does not. Even where the RGPD does not apply, filming a neighbour's private space or the public way without consent can breach Code penal article 226-1, which carries up to one year in prison and a 45,000 EUR fine, as well as Code civil article 9 and the doctrine of trouble anormal de voisinage, which can force removal of the installation. A homeowner who believes the household exemption settles the matter can still lose a civil case and be ordered to take the camera down.

Cameras and Monitoring at Work

Workplace filming is the area where French law is most procedural, and the procedure is often what employers get wrong rather than the camera itself. Workplace cameras require prior information and consultation of the CSE under Code du travail article L.2312-38. They must be proportionate to the purpose being pursued, and they cannot cover break rooms, toilets, union offices, or a workstation on a permanent basis. Sound recording is reserved for exceptional situations.

These are not theoretical limits. The CNIL fined La Samaritaine 100,000 EUR in September 2025 over concealed cameras that also captured employee conversations, and it issued 23 further simplified sanctions totalling 133,750 EUR since January 2026, mostly for unauthorised or permanent filming of employees. The pattern in those files is consistent: continuous monitoring of people at their posts, and installations nobody was properly told about.

Choosing the Right Route

Start by naming the outcome you want, because it selects the forum. If you want an organisation to stop doing something, delete data, or answer a request it has ignored, the regulator is the efficient path, and the complaint costs nothing. If you want money for a harm you can evidence, the CNIL cannot deliver it and a civil claim is the route. If the conduct involves filming private life without consent, the criminal provisions in the Code penal sit alongside both.

Then check which camera regime you are in before arguing about the rules, because public-space videoprotection and private videosurveillance answer to different authorities and different retention limits.

It is also worth doing the unglamorous step first. The CNIL strongly recommends contacting the organisation directly before complaining, and asks you to describe that contact and its outcome in the form. Many files are resolved at that stage, and where they are not, the record of the attempt makes the complaint that follows considerably easier to assess. Keeping dates, copies of what you sent, and any reply you received costs nothing and is useful in every forum, regulatory, civil, or criminal.

For neighbour disputes in particular, remember that two independent questions are in play: whether data protection law applies at all, and whether the filming is a civil or criminal invasion of private life regardless. Losing the first argument does not win the second.

Our wider coverage of French law sets this section in context alongside the other areas we cover for France. Within privacy specifically, the two starting points are the CNIL complaint process and France's camera and surveillance rules.