France has been at the forefront of data protection since 1978 when it enacted one of the world's first national data protection laws (Loi Informatique et Libertés), establishing the CNIL (Commission Nationale de l'Informatique et des Libertés) as the supervisory authority. This heritage continues through robust GDPR implementation, active CNIL enforcement, and specific French requirements that organizations must address. The CNIL has been among Europe's most active data protection authorities, imposing significant fines and establishing detailed guidance on personal data handling.
French personal data has specific characteristics requiring specialized detection—from the NIR (numéro de sécurité sociale) with its complex validation algorithm to distinctive French address formats and business identifiers. Understanding these French particulars is essential for any organization processing French personal data.
The NIR (Numéro de Sécurité Sociale)
The NIR is France's primary personal identifier, used for social security, healthcare, taxes, and various administrative purposes. Its structure encodes personal information:
Format: 15 digits (13 base digits + 2-digit control key)
- Digit 1: Gender (1 = male, 2 = female, 7/8 for temporary numbers)
- Digits 2-3: Year of birth (2 digits)
- Digits 4-5: Month of birth (01-12, or 20-42 for uncertain months)
- Digits 6-7: Département of birth (01-95, 99 for overseas/foreign)
- Digits 8-10: Commune of birth (INSEE code)
- Digits 11-13: Registration order number
- Digits 14-15: Control key (97 - (first 13 digits mod 97))
Corsican Handling: Corsican départements use 2A and 2B instead of numeric codes. For validation, these are converted to numeric equivalents (2A→19, 2B→18) before modulo calculation.
CNIL Restrictions: The CNIL specifically restricts NIR collection and use. Only specific authorized purposes (social security, healthcare, employment) justify NIR processing. Detection helps identify potentially improper NIR presence.
CNIL and French GDPR Implementation
France implements GDPR through the updated Loi Informatique et Libertés and the CNIL's guidance:
CNIL Enforcement: The CNIL has imposed some of Europe's largest GDPR fines, including €150 million against Google, €90 million against Google again, and €60 million against Facebook. Active enforcement makes compliance critical for organizations operating in France.
NIR Processing Restrictions: CNIL guidance specifically limits NIR use to authorized purposes. Organizations cannot freely use NIR as a general identifier—its collection requires legal basis tied to social security, health, or employment purposes.
Cookie and Tracking Rules: CNIL has established detailed guidance on cookies and online tracking that goes beyond general GDPR requirements, affecting how customer data is collected.
Data Retention: CNIL emphasizes data retention limits and has enforced violations. Redaction supports retention compliance by removing identifying data while preserving non-personal content.
French Identity Documents
French identity documents have specific formats:
Carte Nationale d'Identité (CNI): The French national ID card number follows a specific format. New biometric cards (since 2021) use 12 alphanumeric characters; older cards used different formats. The CNI number appears in MRZ format on the card.
French Passport: French passport numbers follow standard format: 2 digits + 2 letters + 5 digits. The MRZ contains additional encoded data including control digits.
Titre de Séjour: Residence permits for foreign nationals use specific numbering systems varying by permit type and issue date.
Permis de Conduire: French driver's license numbers follow formats that have evolved over time, with current licenses using a 12-digit format.
French Business Identifiers
French business identification uses a hierarchical system:
SIREN: 9-digit identifier assigned by INSEE to each legal entity. The last digit is a Luhn check digit. SIREN is unique and permanent for each company.
SIRET: 14 digits = SIREN (9) + NIC (5). SIRET identifies a specific establishment (location) of a company. Each company location has a distinct SIRET.
NIC (Numéro Interne de Classement): 5-digit suffix to SIREN identifying the establishment. The 5th digit is a check digit.
Numéro de TVA Intracommunautaire: French VAT number format: FR + 2 check digits + SIREN. The check key is calculated from SIREN using a specific algorithm.
French Address Formats
French addresses follow specific conventions:
Standard Format: [numéro] [type de voie] [nom de voie], [code postal] [ville]. Example: "25 rue de la Paix, 75002 Paris"
Types de Voie: French uses numerous street type designations: rue, avenue, boulevard, place, allée, chemin, impasse, passage, quai, square, and many others. Abbreviations are common (av., bd., pl.).
Code Postal: 5-digit postal code. First two digits indicate département (75 = Paris, 69 = Rhône, 13 = Bouches-du-Rhône). This enables département identification from postal code.
CEDEX: Business postal addresses often include CEDEX (Courrier d'Entreprise à Distribution Exceptionnelle), indicating special delivery service. CEDEX addresses have a distinct format.
DOM-TOM: Overseas departments and territories use 97xxx (DOM) and 98xxx (TOM) postal codes with territory-specific formats.
French Contact Formats
French contact information follows specific patterns:
Phone Numbers: French numbers are 10 digits displayed as 0X XX XX XX XX. Geographic codes: 01 (Île-de-France), 02 (Northwest), 03 (Northeast), 04 (Southeast), 05 (Southwest). Mobile: 06, 07. Service numbers: 08, 09. International format: +33 X XX XX XX XX.
Email: French business email often uses [email protected] format. Detection handles accented names in email addresses where supported.
French Financial Identifiers
French banking and financial data has specific formats:
French IBAN: FR + 2 check digits + 23 characters (5-digit bank code + 5-digit branch code + 11-character account + 2-digit RIB key). Total: 27 characters.
RIB (Relevé d'Identité Bancaire): The French domestic bank account identifier consisting of bank code, branch code (guichet), account number, and RIB key. While IBAN is now standard, RIB format still appears in older documents.
BIC/SWIFT: French banks use standard BIC format with bank-specific codes.
Healthcare Identifiers
French healthcare uses specific identifiers:
Carte Vitale: The French health insurance card contains the NIR as primary identifier. Carte Vitale numbers are NIR numbers.
RPPS: Répertoire Partagé des Professionnels de Santé identifies healthcare professionals. 11-digit format used for doctors, nurses, and other practitioners.
FINESS: Fichier National des Établissements Sanitaires et Sociaux identifies healthcare facilities with a 9-digit code.
Regulatory Enforcement
France actively enforces data protection requirements:
CNIL Powers: The CNIL can impose fines up to €20 million or 4% of global revenue, conduct audits, issue orders, and publicize violations. The CNIL has used these powers actively.
Recent Actions: Major CNIL actions include fines against Google, Facebook/Meta, Amazon, Microsoft, and many French companies. Both data protection and cookie compliance have been enforcement priorities.
Sectoral Focus: The CNIL has specific guidance for healthcare, employment, and other sectors that creates additional requirements beyond general GDPR.
