Personal data must be collected and processed fairly and lawfully for specified, explicit, and legitimate purposes, and with the consent of the data subject.
In addition to the right to consent, data subjects have been given the following rights: right to be informed, right to object, right of access, right to correct and delete information, and right to be forgotten.
There is no specific personal data protection guarantee in the 1958 Constitution.
The primary text on data protection is Law 78-17 of January 6, 1978, on Information Technologies, Data Files and Civil Liberties, as amended (1978 Law). Its first article sets forth the principle that information technology is at the service of each citizen and cannot violate human identity, human rights, privacy, or individual or public liberties. France, together with Sweden and the German State of Hessen, was one of the first countries in Europe to adopt a data protection law.
The 1978 Law is said to have inspired the drafting of Directive 95/46/EC on personal data protection. The 1995 Directive intended to harmonize the protection of the right to the privacy of individuals with respect to the processing of personal data among Member States. France transposed this Directive by Law 2004-801 of August 6, 2004 (2004 Law). As the 1978 Law was largely compatible with the 1995 Directive, most of its articles remained unchanged and it has kept its original number and is generally referred to as Law 1978 of January 6, 1978, as amended by Law 2004-801 of August 6, 2004.