What Changed
- Reviewed communications regarding fully automated individual decisions under GDPR Article 22.
- Presented the joint CNIL/CIANum note on agentic AI and finalized the 'AI in healthcare context' guide following a hearing with HAS representatives.
- Examined draft deliberations on decrees modifying criminal procedure for DNA (FNAEG) and fingerprint (FAED) databases and processing of complaint files at the High Council of the Judiciary.
The French Data Protection Authority (Commission nationale de l'informatique et des libertés, CNIL) convened its plenary session on Thursday, 5 November 2026, at 9:30 AM. According to the published agenda, the meeting encompassed several key regulatory, advisory, and policy initiatives spanning automated processing, artificial intelligence, law enforcement databases, and judicial administration.
Key agenda items under Part I of the meeting included:
- Automated Decision-Making: A communication concerning fully automated individual decision-making pursuant to Article 22 of the General Data Protection Regulation (GDPR).
- Criminal Procedure and Biometric Databases: Examination of a draft deliberation issuing an opinion on a draft decree amending the French Code of Criminal Procedure regarding the National Automated DNA Database (FNAEG) and the Automated Fingerprint Database (FAED).
- Agentic AI: Presentation of a note titled "Agentic AI and personal data" ("IA agentique et données personnelles"), prepared jointly by CNIL and CIANum.
- AI in Healthcare: A hearing with representatives of the French National Authority for Health (Haute Autorité de santé, HAS) followed by the presentation of the final version of the guide titled "AI in healthcare context" ("IA en contexte de soins").
Under Part II of the session, featuring deliberations adopted pursuant to Article 17 of CNIL's internal rules, the committee examined a draft deliberation issuing an opinion on a proposed processing of personal data designated as "Analysis of complaint files submitted to the High Council of the Judiciary" ("Analyse des dossiers de plainte déposés devant le Conseil supérieur de la magistrature").
Organizations operating automated decision systems under GDPR Article 22, technology vendors developing agentic AI solutions, healthcare providers utilizing AI systems, law enforcement agencies maintaining biometric databases, and judicial administrative bodies are directly impacted by the regulatory guidance and official opinions discussed during this session.
Who May Be Affected
Data controllers using automated processing, AI developers, healthcare providers, French criminal justice authorities managing FNAEG/FAED databases, and the High Council of the Judiciary.
Cross-Border Context
Relevant to businesses and organizations subject to GDPR operating in France or deploying AI models and automated decision systems across the European Union.
What to check next
- Monitor CNIL for subsequent publication of adopted opinions, deliberations, and the final guide 'AI in healthcare context'.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.