Welcome to our newsletter, where we provide insightful legal updates and expert advice on French law, tailored to meet the needs of international clients navigating the complexities of the French legal system
Companies increasingly receive data access requests from employees, sometimes in the context of disputes or negotiations. Refusing such a request can lead to significant financial penalties – up to 4% of the company’s global turnover.
On January 31, 2025, the CNIL (the National Commission on Informatics and Liberty) updated its guidance on employees’ right to access their data, including professional emails, especially for large requests.
Personal data refers to any information identifying a person directly (e.g., name, first name) or indirectly (e.g., mobile number, license plate, social security number, email, voice, or image).
Employees can request access to various employment-related data, including recruitment records, career history, compensation details, disciplinary records, access logs from security badges.
Employees—whether current or former—can submit requests to their employer, often via the Data Protection Officer (DPO) or Human Resources Department. No specific format is required, and employees do not need to justify their request.
Employers must generally respond within 1 month (Article 12.3 of the GDPR). If the request is complex or if multiple requests are received, the employer may extend the deadline by a further 2 months, provided they inform the employee of the use of this additional time within the initial 1-month period.
According to the CNIL, employees can receive their personal data in one of two ways:
Access requests must also comply with:
If an email is marked « personal”, « private, » or includes similar wording (e.g., « family » or « vacation » in the subject line), it must be forwarded to the employee without being read by the employer.
The CNIL provides specific guidances on professional emails:
By 7 June 2026 at the latest, European Directive 2023/970 of 10 May 2023 aimed at reinforcing the application of the principle of equal pay for women and men for equal work or work of equal value through remuneration transparency and its application mechanisms must have been transposed into national law.
French companies need to anticipate these legislative changes to ensure optimum compliance as soon as the new provisions come into force.
The Directive provides for four main changes :
There is an obligation to inform the candidate ‘in the job advertisement or in some other way’ of:
The objective is to enable employees to negotiate their remuneration in an informed and transparent manner.
It also prohibits asking candidates for their remuneration history.
The employer must remind employees of this right once a year. The employer must provide the information within a reasonable period of time, not exceeding 2 months.
The employer may require the employee not to use the information for any purpose other than to exercise his or her right to equal pay.
Companies with at least 100 employees will be required (this obligation being implemented in phases depending on the number of employees in the company) to report data on gender pay gaps on a regular basis to a public authority to be specified in the transposition law. Publication on the website will probably also be required by the transposition law.
As part of the transposition into national law, Member States will have the choice to make companies with fewer than 100 employees subject to this obligation.
The data to be reported will cover :
The companies concerned will have to carry out a joint assessment of pay in cooperation with employee representatives when the data communicated reveals a difference in the average level of pay of at least 5% between women and men, whatever the category of workers.
In France, companies with at least 50 employees already publish an annual index on professional equality, but this will certainly have to change to take into account the transposition of the Directive (from total pay to differences in variable or additional components and from a point-based approach to a percentage-based approach).
***
It should be noted that the Directive also provides for a reversal of the burden of proof: if the employer has not fulfilled his obligations to provide individual information and to publish pay data, it will then be up to him to prove that there has been no discrimination.
It is therefore necessary to anticipate the transposition of the directive, in particular by :
We remains at your disposal to help you with the above.
Pour recevoir l'Actu Tendance, incrivez-vous ci-dessous (Politique de confidentialité)