French Code of Criminal Procedure
In forceI.-The right to object provided for in article 38 of Law no. 78-17 of 6 January 1978 relating to information technology, files and freedoms does not apply to this processing operation.
Any person identified in the file as a victim may, however, object to personal data concerning him or her being kept in the file once the perpetrator has been convicted. Such persons shall be informed of their right to object.
II.-Without prejudice to the application of article R. 40-31, the rights of information, access, rectification and deletion provided for in articles 70-18 to 70-20 of the same law may be exercised directly with the data controller.
III.-In order to avoid hindering investigations, enquiries and administrative or judicial proceedings and to avoid prejudicing investigations, prosecutions or the enforcement of criminal penalties, the rights of access, rectification and deletion may be subject to restrictions pursuant to 2° and 3° of II and III of article 70-21 of the same law.
The person concerned by these restrictions shall exercise his/her rights with the Commission nationale de l'informatique et des libertés under the conditions provided for in article 70-22 of the same law.
The request sent to the Commission nationale de l'informatique et des libertés is processed within six months. Upon receipt of the request, the data controller has one and a half months to refer the matter to the public prosecutor. This period may be extended by a further month if the processing of the request requires complex investigations. The Commission is informed of this by the data controller. The Public Prosecutor has three months to decide what action to take on the request. He shall communicate his instructions to the data controller who, within fifteen days, shall inform the Commission of the action taken on the request.
Where the information contained in the processing operation is the subject of legal proceedings, it may only be communicated if these proceedings have been closed. However, the Commission may determine, with the agreement of the data controller, that personal data recorded does not involve State security, defence or public safety and that it should therefore be communicated to the interested party, with the agreement of the public prosecutor when the proceedings have not been closed.
