The Sapin II Law and the GDPR: Two Regulatory Frameworks That Are Difficult to Implement

Article published on July 15, 2020, in Option Droit et Affaires - here.

Internal investigations within French companies have grown in particular as a result of the Sapin II Act, but conducting them raises significant conflicts with the requirements of the GDPR. On the one hand, the confidentiality essential to any internal investigation clashes with the right to information and the right of access of the individuals concerned, even though attorney-client privilege serves as a useful safeguard. On the other hand, the principles of data minimization and proportionality regarding data retention periods are difficult to reconcile with the evolving and sometimes very lengthy nature of internal investigations, requiring companies to constantly reassess the relevance of the data collected.