Hacker News Reader

Comment by AceJohnny2 | Hacker News Reader

Tangentially, France has had the CNIL [1] since ~1978, following a scandal about creating a national citizen's database, and exists to prevent exactly that. (I believe the objection stemmed from memories of the Petainist fascist regime during WW2)

The CNIL is why France (and now Europe) has "Right to Forget" laws. It is the direct ancestor of stuff like GDPR.

Unfortunately, I feel like the CNIL is fairly neutered nowadays. Nevertheless, it serves as historical precedent, for those who remember it exists.

[1] "Commission Nationale de l'Informatique et des Libertes" ~= "National Commission of Computing & Liberties"

View on HN

This goes well beyond historical precedent. The legal system is complex, but even when Parliament approves a law, it can still be struck down if it violates fundamental principles.

For matters concerning IT and privacy, the CNIL (French Data Protection Authority) could spearhead such cancellation proceedings.

And companies doing business in France should watch out—CNIL sanctions are no joke!

Are there specific events making you feel it has been neutered?

I wonder if not having such state database is not causing today more issues than it defends from.

In the 80s I would get it, the state was the only one able to build such a database and people were afraid of what it would do secretly with it. Nowadays, "everybody" has a database with millions of people (ex: facebook, linkedin, x, tax offices, etc.) and discriminatory actions are done based on whims/stupidity rather than on actual good data.

People will do horrible stuff because they believe in it, not because they have good data.

The CNIL is doing a ton of work to limit private databases and cross-checking as well.

It can be hard to believe from more business focused countries, but the agency setting precedents has had dissuasion effects, and most companies do end up caring about their data retention and management policies. I've been in enough meetings where UX proposal gets entirely reworked because of a simple link to the CNIL's guidelines.

I checked the list of the fines (https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil). They are definitely doing good things, but they do not seem to be very active to prevent companies to gather large databases if they can give some reason (ex: facebook / linkedin / etc.).

And I am fine if your opinion is that less data collection is better everywhere, but this idea should be applied to everybody (government & private entities). My opinion is that if you fear much more the government than private entities you give those private entities an advantage.

Linkedin has been fined for their use of personal data for ad purposes (albeit through the RGPD framework after the CNIL passed the case to them):

https://www.lemonde.fr/pixels/article/2024/10/24/donnees-per...

Facebook is also targeted under the RGPD, we've been amply seeing the news. The CNIL doesn't need to be doing everything either.

There is and will be no silver bullet completely stopping companies from building databases. I see having an active agency responding to user feedback as at least a decent counterbalance to it, when it's a complete shit show in so many other countries.

> government

Right now the government having extensive databases allows people to manage all their health payments and data in one place, including any hospital getting access to their full history when they're brought in pain barely able to speak. That also includes ease to vote on the net within minutes, check school records on a standardized site etc.

It's not perfect and probably abused in some way, but right now the net benefit at scale largely overshadows those IMHO.

Registration as an expat in the Netherlands is much smoother than in France, for things like taxes, health, pension stuff, municipality stuff, etc. (not to mention at the time I did in NL I did not know the language and I know well French). You basically register in one place and lots of things are pulled from there when needed by other branch of government.

In France at almost each new authority I interacted with I needed to provide again the same information, while for all intents and purposes the government has it already (just that in another database).

My impression is that lot of effort is wasted due to duplication (including verification, updating, lack of cross referencing) and not sure why (if the case is that "we have N databases because people can't get together to agree on one", that would make some sense ...)

Reply on news.ycombinator.com