Privacy Policy

Introduction

The Conseil national des barreaux (CNB) is a public-interest body endowed with legal personality, established by Law No. 90-1259 of 31 December 1990. Since 1992, it has been the institution representing all lawyers in France.

Pursuant to Law No. 71-1130 of 31 December 1971 (as amended by several decrees, including Decree No. 91-1197 of 27 November 1991 organising the legal profession and Decree No. 2005-790 of 12 July 2005 relating to the ethical rules governing the legal profession), the Conseil national des barreaux has been entrusted with specific statutory duties relating to the organisation of the profession, including in particular:

representing the legal profession, notably before public authorities;
harmonising, by way of general provisions, the rules and practices of the legal profession;
determining, in consultation with the Minister of Justice, the terms and conditions for implementing the lawyers’ private independent network (RPVA) for the purpose of interconnection with the Justice Virtual Private Network (RPVJ);
ensuring the operation and development of technical tools designed to promote the digitisation of exchanges between lawyers;
establishing, updating and making available online a national directory of lawyers registered with a Bar, based on information provided by the local Bar Councils;
defining the principles governing the organisation of initial and continuing professional training for lawyers and harmonising training programmes;
issuing decisions on applications for admission submitted by EU and non-EU foreign lawyers wishing to join a French Bar and determining the list of lawyers from foreign Bars eligible to register with a French Bar.

Accordingly, the Conseil national des barreaux is required to collect and process personal data in the course of its activities.

With a view to fostering innovation while building a lasting relationship of trust based on respect for individuals’ rights and freedoms, the Conseil national des barreaux implements the necessary technical and organisational measures to protect the personal data it processes.

The primary objective of this policy is to set out, in a concise, transparent, intelligible and easily accessible format, the values and commitments of the Conseil national des barreaux regarding data protection, as well as information concerning the data processing operations implemented, in order to enable you to understand the conditions under which your data are processed, your rights in this regard, and how you may exercise them.

I. Who Are We?

1. Data Controller

The Conseil national des barreaux is a public-interest body endowed with legal personality, whose registered office is located at 180 boulevard Haussmann – 75008 Paris, registered in the SIRENE directory under number 391 576 964 and with SIRET number 391 576 964 00053.

2. Data Protection Officer

The Conseil national des barreaux has appointed a Data Protection Officer (DPO), whose contact details are as follows:

By post: Conseil national des barreaux, Data Protection Officer, 180 boulevard Haussmann – 75008 Paris
By email: donneespersonnelles@cnb.avocat.fr

The Data Protection Officer is responsible in particular for advising, informing and monitoring compliance with data protection regulations. The DPO will be your primary contact for the exercise of your rights (hereinafter referred to as…).

1. We Implement Fair and Transparent Processing

In the interest of transparency, the Conseil national des barreaux ensures that data subjects are informed of each processing operation concerning them.

Whenever a new personal data processing operation is implemented, appropriate information notices are systematically included in the data collection materials. With regard to digital services offered or operated under the responsibility of the Conseil national des barreaux, “Personal Data Protection” clauses, incorporated directly into the general terms of use or into privacy policies, are made available to you and are systematically presented during the initial account creation or activation process.

This information includes the categories of data processed, the categories of data subjects concerned, the purpose(s) of the processing, the retention period applicable to your data, the legal basis for the processing, the recipients of the data, the existence or absence of transfers of your data outside the European Union and, where applicable, the existence of automated processing.

2. We Systematically Base Our Processing on a Specific Purpose

Whenever the Conseil national des barreaux processes data, it does so for specific purposes. Each data processing operation implemented pursues a legitimate, determined and explicit purpose, which is explained to you in the relevant information notices, available privacy policies and/or in this external data protection policy.

3. We Implement Proportionate Data Processing

For each processing operation implemented, the Conseil national des barreaux undertakes to process only data that are adequate, relevant and limited to what is necessary in light of the defined purposes.

The Conseil national des barreaux ensures the quality of data: they are regularly updated on the basis of declarations received, and procedures are implemented to enable the erasure or rectification of inaccurate data.

There are, however, situations in which neither the Conseil national des barreaux nor the data subjects can directly modify their data.

This is notably the case with regard to data relating to the professional life of lawyers that we process in the context of publishing and operating the national directory of lawyers in France, or authentication and identification data used for access to digital services.

In such cases, your data originate from the local Bar Councils, which are solely authorised to manage their official roll pursuant to Article 17, 1° bis of Law No. 71-1130 of 31 December 1971 reforming certain judicial and legal professions.

In the event of error, obsolescence, incompleteness, or more generally where modifications to such data are necessary, the lawyer concerned is invited to contact without delay their Bar Council or, for lawyers registered with the Paris Bar, the Professional Practice Department of their Bar.

4. We Retain Data Only for the Period Necessary to Achieve the Defined Purposes

The Conseil national des barreaux establishes retention periods for each personal data processing operation it implements.

In determining such periods, we rely on the purpose pursued by the processing, as well as on recommendations issued by the French Data Protection Authority (CNIL) and the guidelines of the European Data Protection Board.

III. Our Requirements

1. Ensuring the Security of Your Data

Mindful of fostering innovation while building a lasting relationship of trust based on respect for individuals’ rights and freedoms, the Conseil national des barreaux places particular importance on the security of your data.

Appropriate technical and organisational measures are implemented to ensure that your data are processed in a manner that guarantees protection against loss, destruction, or accidental damage that could compromise their confidentiality or integrity.

During the design and development of systems, or when selecting and using tools that allow the processing of your data, the Conseil national des barreaux ensures that they provide an optimal level of protection for the personal data processed.

The Conseil national des barreaux implements measures respecting the principles of privacy by design and privacy by default. To this end, it may employ pseudonymisation or encryption techniques whenever feasible and/or necessary.

Regular security audits are conducted on its information systems and those of its service providers to ensure compliance with its security requirements.

2. Carefully Selecting Our Data Processors

The Conseil national des barreaux selects its partners, referred to as “processors” under data protection law, based on compliance criteria required by applicable regulations.

When engaging a processor, the Conseil national des barreaux only communicates personal data after obtaining from the processor commitments and guarantees regarding its ability to meet these security and confidentiality requirements.

Contracts are concluded with processors in accordance with legal and regulatory obligations, clearly defining the conditions and methods for processing personal data.

Similarly, the Conseil national des barreaux carries out or commissions security audits of its service providers to verify that data security rules are correctly applied.

IV. Our Personal Data Processing

1. Personal Data We Process

Within the scope of personal data processing operations, whose purposes will be detailed below, the Conseil national des barreaux primarily collects and processes the following categories of data:

Identification data : such as the last name(s) and first name(s) of the data subjects;
Professional life data : including profession, professional contact details, distinctions, areas of expertise, and/or certificates of specialisation obtained;
Economic and financial information;
Personal life data : such as postal address and date of birth, excluding information related to lifestyle habits;
Connection data : including application event logs and IP addresses in certain cases;
Image and/or voice data : captured during interventions at events, training sessions, or competitions organised by the Conseil national des barreaux;
Data appearing in official documents : such as copies of identity documents, professional cards, registration certificates, K-bis extracts, or SIRENE registration notices.

The Conseil national des barreaux also processes data relating to the union membership of its members, notably in the context of elections for each new mandate, or of third parties in relation to institutional management, where:

such data are publicly disclosed by the data subject;or
processing is conducted within the framework of the Conseil national des barreaux legitimate institutional activities.

Where data are mandatory for the conclusion of a contract or to comply with legal or regulatory obligations, the collection forms will specify this in the information notices provided to data subjects or in the privacy policy for a specific service. Failure to provide this information may result in the request not being processed or being delayed.

The Conseil national des barreaux does not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, nor genetic data, biometric data for uniquely identifying a person, or data concerning sexual life or sexual orientation.

2. Sources of the Data We Process

The data processed may originate from:

Data you provide directly to us;
Other actors in a lawyer’s professional life or trainee lawyers, who provide it to us under legal provisions;
Open sources, including open data platforms.

2.1 Data You Provide Directly

This includes personal data you provide in connection with:

Correspondence with the Conseil national des barreaux, including information requests via the contact details published on the CNB institutional website;
Account creation or activation on CNB-managed digital services (e-Barreau, e-ASSP, e-Partage, e-Formation, Consultation.avocat.fr, private cloud, etc.);
Management of authentication and identification of lawyers on CNB digital services and those of institutional partners (e.g., e-Dentitas for access to Télérecours, Opalexe, Wifi Avocats, TIG 360°, etc.);
Applications for admission of foreign lawyers;
Applications for lawyer specialisation;
Requests for accreditation of continuing professional training;
Requests for “Avocats keys” or renewal of security certificates (eIDAS, RGS**, etc.);
Registration for events and training organised by the CNB;
Subscription to CNB newsletters via the institutional website or provided contact details;
Participation in classified ads services, including publication of ads and receipt of responses;
Collection and recovery of membership fees;
Requests for ethical or technical opinions from Bar Presidents and their delegates;
Analysis and measurement of CNB-managed websites’ traffic;
Professional studies, surveys, or polls to better understand the lawyer profession;
Customer satisfaction surveys;
Management of competitions organised by the CNB (registration, selection, communication);
Organisation of the “Innovative Projects” competition;
Management of the alumni community of the Innovative Projects competition;
Management of the CNB members’ directory;
Organisation of members’ commission travel;
Management of international contacts and counterparts;
Handling of referencing requests by the National Lawyer Mediation Centre;
Management of the National CRFPA Examination Commission;
Video surveillance of CNB premises;
Management of the journalist directory linked to the institution;
Handling assistance requests for incidents reported or detected at the CNB Service Centre;
Management of services via the “Law Day in Schools” platform;
Management of the National Consumer Mediator platform (limited to platform maintenance and functionalities);
Management of data subject rights requests (analysis, response, execution tracking);
Management of personalised participant accounts on Compte-Evènement.cnb.avocat.fr.

These data are primarily collected via forms, paper or electronic questionnaires, and information notices or privacy policies are systematically provided.

2.2 Data from Third Parties or Other Institutions

For lawyers, personal data may also come from:

Local Bar Councils;
The National Union of Lawyers’ Payment Funds (UNCA);
Regional Lawyer Training Centres (CRFPA), for continuing education or specialisation;
The GIE BRA;
Institutional partners, notably for civil, criminal, administrative, and commercial electronic communications (Ministry of Justice, Conseil d’État, CNCJ, CNCEJ, GIE Infogreffe, CSN).

These data may feed into the following processing operations:

Operation and availability of the national directory of lawyers on the CNB institutional site and on avocat.fr;
Management of lawyer specialisation applications;
Management of the directory of specialist lawyers;
Subscription management for electronic communications;
Organisation of CNB member elections (digital only);
Management of communications to candidates for CNB elections;
Authentication and identification of lawyers on CNB digital services and those of institutional partners;
Management of CNB-managed digital services (e-Barreau, e-ASSP, e-Partage, e-Formation, Consultation.avocat.fr, Encyclopaedia of Lawyers, private cloud, etc.);
Management of the National Lawyer Mediation Centre directory;
Collection and recovery of membership fees;
Handling, where applicable, of ethical opinion requests;
Management of institutional relations;
Management of newsletter subscriptions;
Handling, where applicable, of personal data rights requests.

For trainee lawyers, personal data may also come from:

Regional Lawyer Training Centres (CRFPA);
Examination centres for the CRFPA entry examination.

These data feed into processing operations such as:

Managing the list of admitted candidates to the CRFPA entry exam;
Centralising initial training registration requests for allocation across France;
Grant allocation and payment to registered trainee lawyers;
Monitoring CAPA results to prevent fraud;
Management of authentication and access to digital documentation services provided by CRFPA and CNB;
Management of CNB competitions (registration, selection, communication);
Management of newsletter subscriptions.

2.3 Data from Open Sources

Data obtained from open sources primarily consist of contact details available on official websites, such as data.gouv.fr. When processing such data, the Conseil national des barreaux complies with applicable licensing terms and the guidance issued by the CADA (Commission on Access to Administrative Documents) and the CNIL (French Data Protection Authority).

These data feed into the following processing operations:

Distribution of newsletters specifically designed for parliamentarians and other political representatives;
Management of institutional relations.

3. Legal Bases and Purposes of Our Data Processing

Processing operations conducted by the Conseil national des barreaux may be necessary for the performance of a contract or to take pre-contractual measures at the request of the data subject. This applies to processing operations serving purposes such as:

Organisation of events and continuing education;
Provision and operation of digital services directly offered by the CNB (new e-Barreau, e-ASSP, e-Partage, Consultation.avocat.fr, private cloud, etc.);
Management of lawyers’ email accounts and document storage (e-Messaging & e-Drive);
Authentication and identification of lawyers accessing services offered by the CNB and institutional partners (e.g., e-Dentitas for access to Télérecours, Opalexe, Wifi Avocats, TIG 360°, etc.);
Requests for issuance of eIDAS, RGS** security certificates and Avocats keys;
CNB’s accreditation as an administrative registration authority for security certificates and Avocats keys;
Management of competitions organised by the CNB (registration, selection, communication);
Management of personalised participant accounts on Compte-Evènement.cnb.avocat.fr;
Organisation of the “Innovative Projects” competition;
Management of journalistic reports and videos.

Processing operations may also be necessary to comply with legal and regulatory obligations, such as:

Organisation of CNB member elections (digital only);
Management of disputes or litigation, including enforcement proceedings where applicable;
Collection and recovery of membership fees;
Accounting operations;
Processing and tracking of data subject rights requests;
Management of the national directory of lawyers;
Handling of ethical opinion requests;
Accreditation of continuing education;
Monitoring CNB representation in school boards;
Administration and financing of schools;
Management of the National CRFPA Examination Commission and exam results;
Management of specialist lawyer directories;
Specialisation certificates and specific qualifications;
Admission of foreign lawyers;
Electronic communications subscriptions;
Professional alerts to detect illicit or prohibited behaviour;
Appointment of third-party arbitrators for ethical disputes;
Other public-interest missions or operational duties.

Where processing is based on consent, data subjects are informed and invited to provide consent, e.g., for:

Post-event or post-training communications;
Alumni networks from the Innovative Projects competition;
Digital service tester communities;
Lawyers wishing to be contacted for targeted studies;
Lawyer panels for professional surveys;
“Law Day in Schools” platform services;
Presentations to elected CNB members;
Photo competitions;
Analysis and measurement of site traffic, including digital referral URLs;
Geolocation on Consultation.avocat.fr;
Collection of feedback and political positions from candidates on the legal profession and justice.

4. Data Recipients

Personal data collected and subsequently obtained are primarily intended for the Conseil national des barreaux in its capacity as data controller, or jointly with CRFPA for the operation of its e-learning platform.

Data may also be disclosed, depending on their role and need to know, to the following categories of recipients:

CNB staff;
Elected CNB members;
Service providers engaged in CNB missions;
Local Bar Councils, UNCA, and GIE BRA in certain cases;
CRFPA and Examination Centres (for CRFPA entry exams);
Institutional partners (for civil, criminal, and administrative electronic communications);
Tax and social authorities;
Competent authorities for the prevention, investigation, and prosecution of offences.

Access to data is restricted to authorised personnel. The CNB implements strict access policies ensuring data are only accessible to authorised persons.

Where a service provider assists in a CNB mission, access to personal data is granted strictly on a need-to-know basis and under confidentiality and data processing agreements.

5. Data Transfers

The Conseil national des barreaux does not transfer your data outside the European Union unless such transfer is based on:

Adequacy decisions issued by the European Commission;
Standard contractual clauses;
Binding corporate rules;or
Exceptions for specific situations (your consent, necessary transfers for contract performance or pre-contractual measures requested by you, etc.).

In any event, if CNB needs to transfer data outside the EU, it will only do so after taking appropriate measures to ensure a level of data protection and security equivalent to that provided within the EU, and you will be informed in advance.

6. Data Retention Periods

The Conseil national des barreaux ensures that personal data are retained in a form allowing identification of data subjects only for as long as necessary for the purposes for which they are processed.

Retention periods applied to personal data are proportionate to the purposes for which the data were collected.

Specifically, the CNB organises its data retention policy as follows (tables reproduced on subsequent pages).

V. Your Rights

The Conseil national des barreaux (CNB) is particularly committed to respecting the rights granted to you under the data processing operations it implements, to ensure fair and transparent processing in consideration of the specific circumstances and context in which your personal data are processed.

1. Your Right of Access

You have the right to obtain confirmation as to whether your personal data are being processed, and if so, you have the right to request a copy of your data and information regarding:

The purposes of the processing;
The categories of personal data concerned;
The recipients or categories of recipients, and, where applicable, the international organizations to which the personal data have been or will be disclosed, particularly recipients established in third countries;
Where possible, the envisaged retention period of personal data or, if not possible, the criteria used to determine this period;The rectification or erasure of your personal data, the restriction of the processing of your personal data, and your right to object to such processing;
The right to lodge a complaint with a supervisory authority;
Information regarding the source of the data if it was not collected directly from you;
The existence of automated decision-making, including profiling, and in such cases, meaningful information about the underlying logic, as well as the significance and expected consequences of this processing for you.

2. Your Right to Rectification

You may request that your personal data be rectified or completed if they are inaccurate, incomplete, ambiguous, or outdated.

However, there are situations in which neither the CNB nor the data subjects can directly modify their data. This is particularly the case for data relating to a lawyer’s professional life, which are processed for the publication of the directory of lawyers in France, or for authentication and identification data for access to digital services.
In such cases, your data come from the local Bar Councils, which are solely responsible for managing their registers, pursuant to Article 17, 1° bis of Law No. 71-1130 of 31 December 1971 reforming certain judicial and legal professions.
In the event of errors, obsolescence, incompleteness, or other necessary modifications, lawyers are invited to contact their Bar Council immediately or, for Parisian lawyers, the Professional Practice Department of their council.

3. Your Right to Erasure

You may request the deletion of your personal data when one of the following grounds applies:

The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
You withdraw previously given consent;
You object to the processing of your personal data when there is no compelling legitimate reason for the processing;
The processing of personal data is not in compliance with applicable laws and regulations.

Please note that the right to erasure is not a general right and will only be granted if one of the above grounds applies and if the situation or data processing does not fall under limitations such as:

Exercise of the right to freedom of expression and information;
Compliance with a legal obligation or the performance of a task carried out in the public interest;
Archival purposes in the public interest, scientific or historical research, or statistical purposes;
Establishment, exercise, or defense of legal claims.

If none of these grounds apply, the CNB will not be able to comply with your deletion request.

4. Your Right to Restrict Processing

You may request the restriction of processing in the cases provided by law:

While verification of the accuracy of your personal data is carried out;
Where the processing is unlawful and you oppose the deletion of your data, requesting restriction instead;
Where CNB no longer needs your personal data but you require their retention to exercise your rights;

During the verification of legitimate grounds when you have objected to processing.

5. Your Right to Object to Processing

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data based on legitimate interests pursued by CNB or the performance of a task in the public interest.
If you exercise this right, CNB will no longer process your personal data for the relevant processing operation unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.
You also have the right to object to marketing, including profiling related to such marketing.
For postal or telephone marketing, you may object at any time;
For electronic marketing (email, SMS, MMS) of a professional or institutional nature, CNB may process your data if you have not objected beforehand after being informed. You may subsequently object at any time via the link in the email or by sending “stop” to the number indicated in the message.

6. Your Right to Data Portability

You have the right to data portability. This is not a general right, as it only applies to automated processing, excluding manual or paper-based processing. This right is limited to processing based on your consent or the performance of pre-contractual measures or a contract. This right does not include derived or inferred data created by CNB.
Personal data subject to this right include:

Only your personal data, excluding anonymized or non-relevant data;
Declarative personal data as well as functional personal data mentioned previously.
Portability may not infringe on the rights and freedoms of third parties, including business secrets.

You may request data portability by specifying whether you wish to receive the data yourself or, if technically feasible, have them transmitted directly to another data controller. You must provide the recipient’s full name, contact details, and the service or person designated to receive the data. You must also inform the recipient of your request.

7. Your Right to Withdraw Consent

Where processing is based on your consent, you may withdraw it at any time. CNB will then cease processing your personal data, without affecting prior processing carried out with your consent.

8. Your Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with the French Data Protection Authority (CNIL) without prejudice to any other administrative or judicial remedies.
You can contact CNIL:

By post: CNIL, Service des plaintes, 3 Place de Fontenoy, 75007 Paris;
Electronically: https://www.cnil.fr/fr/plaintes

You may also bring a case before the competent administrative or judicial court if you consider that CNB’s processing of your personal data violates applicable law.

9. Your Right to Define Post-Mortem Instructions

You may define specific instructions regarding the retention, deletion, and disclosure of your personal data after your death. These instructions apply only to data processed by CNB. You may also define general instructions through the designated executor for the same purposes.

10. How to Exercise Your Rights

All rights may be exercised:

Electronically: donneespersonnelles@cnb.avocat.fr
By post: Conseil national des barreaux, DPO, 180 boulevard Haussmann, 75008 Paris

Proof of identity is required under Article 77 of Decree No. 2019-536 of 29 May 2019. For lawyers, a copy of the professional card is sufficient.

CNB will respond within one month of receipt of your request, extendable by two months in cases of multiple requests or complex matters.

VI. Modifications of This Document

You are invited to consult this policy regularly on our website. Updates may be made as necessary.

Last updated: 31 May 2024