On May 5, 2022, the French Data protection authority CNIL issued a formal notice to 22 municipalities for not having designated a Data Protection Officer (DPO). However, this obligation provided for by Article 37 of the GDPR applies to any public body implementing personal data processing.

Stéphanie Berland, partner in charge of the IP / IT / Data practice, reviewed the issues related to the implementation of this specific provision for Options Droit & Affaires.