REGIONS and the GDPR

In France, a region is a territorial community resulting from decentralization, endowed with legal personality and freedom of administration, as well as an administrative division of the territory and decentralized services of the State.

The regions, as communities, have two assemblies, unlike other communities which have only one: a deliberative assembly, the regional council, and a consultative assembly, the regional economic, social and environmental council, representing the "living forces" of the region. The president of the regional council constitutes the executive of the community.

Personal data that may be processed by departments concerning their citizens may include:

    • Identification data: Civil status, address, telephone number, email address, etc.

    • Economic and financial data: banking data, income, assets, taxation, etc.

    • Data relating to personal life: family status, professional status, training, etc.

    • Health data: particularly through the activity of managing social benefits.

    • Data concerning municipal personnel: identity, contact details, skills, etc.

Departments, as local authorities, must appoint a DPO and comply with the principles of the Data Protection Act and the General Data Protection Regulation (GDPR) regarding the processing of personal data. In particular, they must ensure the security and confidentiality of data and inform data subjects of their rights.