PUBLIC ESTABLISHMENT OF AN INDUSTRIAL AND COMMERCIAL NATURE (EPIC) and the GDPR

A Public Industrial and Commercial Establishment (EPIC) is a type of public body in France that engages in economic, commercial, or industrial activity. Unlike a public administrative establishment, an EPIC has a certain degree of management autonomy and operates on the model of a private company.

EPICs are generally created to carry out commercial or industrial activities on behalf of the State or local authorities, using public resources and skills to provide goods or services to the population.

Examples of EPICs include public transport services (SNCF, RATP), energy distribution services (EDF, Engie), and postal services (La Poste).

A Public Industrial and Commercial Establishment (EPIC) may be required to collect and process different categories of personal data, notably :

    • User or customer identification data;

    • Contact details (address, telephone number, email address);

    • Data relating to the family or professional situation of users or customers;

    • Financial data, particularly for payments or invoicing;

    • Health data, for public establishments responsible for health;

    • Geolocation data, for public establishments in charge of transport, for example.

It is important to note that the collection and processing of personal data by an EPIC are governed by strict rules regarding the protection of personal data, in particular the General Data Protection Regulation (GDPR).