Data processing

The intervention framework of the PEReN is mainly declined according to three modalities defined by its creation decree and the law of October 25, 2021:

Partnership: PEReN may establish agreements with government departments or independent authorities involved in the regulation of digital platforms;
Experimentation: PEReN can build on its own initiative prototypes of regulatory tools and to this end collect publicly accessible data, without the platforms being able to object;
Research work: PEReN may carry out public research work, alone or in partnership, within the meaning of Article L. 112-1 of the Research Code.

All data processing carried out by PEReN is in compliance with the General Data Protection Regulation (RGPD) and the French Data Protection Act.

Experimentation and automated data processing

The experiments conducted by PEReN are proofs of concept that can rely on the collection and exploitation of publicly accessible content from digital platforms. In this context, the data collected :

are kept for no longer than nine months;
are not used for any purpose other than the development of a tool or test.

An experiment may consist in designing a digital tool to verify whether a platform's algorithm is fair or works as described, and personal data may be collected during the tests carried out (for example, the names of users who have left comments on a page). These collections are specifically implemented under the conditions and limits provided by Decree No. 2022-603 of April 21, 2022 (articles 2 to 6) and comply with the rules specified in the PEReN Decision of July 1, 2022 .

Each experimentation provides for:

minimization of the data collected: only strictly necessary data are collected;
the use of secure protocols for content retrieval and processing;
the recording of all the operations carried out within the framework of the treatment of the collected data: consultation, modification, communication, deletion. This recording is kept for three years.
the automatic destruction of all data collected at the end of the work and at the latest nine months after their collection.

Exercising your rights

As part of its activities defined by the October 25, 2021 law and the August 31, 2020 decree, PEReN is currently conducting projects that may lead to the collection of personal data regarding the following platforms:

Google (Bard, Maps)
Microsoft (Bing)
OpenAI
Snap (Discover, MyAI, Map, Spotlight)
TikTok
Waze

In the same context, PEReN may also use the following pre-trained models or training datasets:
Dataset

Models

In accordance with the French Data Protection Act of January 6, 1978, you have the right to access, rectify, limit, oppose and delete data concerning you that may be collected in the context of these experiments and research projects. Data will be deleted no later than 9 months after collection, unless otherwise specified in the case of public research projects
You can exercise this right by sending a message to the PEReN team: refdcp.peren [at] finances.gouv.fr

Reference texts

Decree no. 2020-1102 of August 31, 2020 creating a service with a national scope called "Pôle d'expertise de la régulation numérique" (PEReN) ;
LAW No. 2021-1382 of October 25, 2021 on the regulation and protection of access to cultural works in the digital age (Article 36);
Decree no. 2022-603 of April 21, 2022 establishing the list of independent administrative and public authorities that can call on the support of the Digital Regulation Expertise Unit and relating to the data collection methods implemented by this service in the context of its experimental activities;
Decision of July 1, 2022 on the creation by the Pôle d'Expertise de la Régulation Numérique (PEReN) of an automated processing of personal data implemented as part of the experimentation activities.