In April the French Data Protection Authority (CNIL) reported they had issued a $40,972 fine against a subsidiary of U.S.-based Tyco Healthcare in March for inadequate storage safeguards and cross-border transfer of employee personally identifiable information (PII).
Tyco Healthcare first notified CNIL, as required by France’s data protection law, in September 2004 that they were maintaining a database with employee PII as part of their HR tool.
CNIL subsequently requested more information about the purpose of the database and where the data was transferred. Although Tyco Healthcare told CNIL that they stopped using the database, when CNIL inspected them in July 2006 they found it was still active and contained even more PII than was reported to them.
Besides the fine CNIL has requested additional information to be provided, including information about the destination of data, specifically why data transfers are necessary, proof of adequate data protection safeguards, measures to maintain confidentiality, data retention, and all storage locations.
This validates that CNIL is, and likely will be increasingly, aggressive in reviewing cross-border data transfers and ensuring companies follow data collection, protection and use laws, as well as French labor and privacy laws.
Add this to your file of examples of how other countries can, and will, enforce their data protection laws.
Tags: awareness and training, CNIL, cross border data flow, data protection, employee privacy, France, government, Information Security, IT compliance, policies and procedures, privacy