Many public bodies have access to data covered by banking secrecy under strictly controlled conditions. Here is a detailed analysis of the prerogatives of these public bodies.
1. Court of Auditors and regional chambers
The Court of Auditors and the regional audit chambers have extensive powers to access confidential banking information.
Article L.141-5 of the Financial Jurisdictions Code clearly states that the magistrates of the Cour des Comptes are authorised to exercise directly the right of communication held by the agents of the tax services. This power is also granted to the magistrates of the regional audit chambers by article L.241-2 of the same code.
In their requests to the banks, these magistrates must :
- State the precise nature of the investigation justifying access to information
- Comply with the framework defined by Articles L.83 and L.85 of the French Tax Procedures Code (Livre des procédures fiscales)
Since March 2022, article L.141-5 has been strengthened to specify that no secret protected by law may be invoked against the Cour des Comptes (Order no. 2022-408 of 23 March 2022).
If a bank refuses to provide the documents requested, it is liable to a fine of 15,000 euros.
2. Social security bodies
Communication rights
Law 2007-1786 of 19 December 2007 considerably strengthened the investigative powers of social security bodies.
Article L.114-19 of the French Social Security Code allows employees of these bodies to obtain the information they need from banks:
- Checking the accuracy of returns filed
- Check the authenticity of documents produced for the award of services
- Carrying out collection control missions
In practice, these agents can ask the banks:
- Their customers' account statements
- Account opening dates
- The existence of a power of attorney
These requests must be targeted and proportionate. Circular DSS/2011/233 of 21 July 2011 states: "The principle of selectivity of requests must apply to all operations carried out as part of the exercise of the right of communication."
Refusal to communicate is punishable by a penalty of 1,500 euros per contributor, insured person or beneficiary concerned, up to a maximum of 10,000 euros.
Protection of customer consent
The customer's consent to the lifting of banking secrecy must be free and informed.
In its decision of 30 December 2009 (no. 306173, Société Experian), the Conseil d'État laid down two essential conditions:
- The customer must freely and expressly consent to
- They must have full information to enable them to make an informed decision.
In its decision no. 2007-044 of 8 March 2007, the CNIL also stated that consent obtained at the time of a credit application, without specifying the exact data transmitted, cannot be considered valid.
3. CNIL and personal data protection
The Commission Nationale de l'Informatique et des Libertés (CNIL) has extensive powers to monitor the data processing carried out by banks.
Article 19 of Law no. 78-17 of 6 January 1978 (in its current version) authorises the CNIL to:
- Access to bank business premises from 6 a.m. to 9 p.m.
- Request all necessary documents
- Gather all information relevant to its mission
Can banking secrecy be invoked against the CNIL? Article 18 of the Act states that professional secrecy may be invoked, but the Constitutional Council has ruled that "unjustified invocation of professional secrecy could constitute an obstacle" (decision no. 2004-499 DC of 29 July 2004).
This obstruction is punishable by one year's imprisonment and a fine of €15,000 (article 226-22-2 of the French Criminal Code).
In particular, the CNIL ruled that a credit institution could not hide behind banking secrecy to refuse to provide information requested by a customer (Deliberation no. 2006-174 of 28 June 2006).
4. Ombudsman
The Human Rights Defender, established by article 71-1 of the Constitution and governed by organic law no. 2011-333 of 29 March 2011, has investigative powers that may affect banking secrecy.
According to article 20 of this organic law:
- The persons implicated must provide "all information and documents relevant to the performance of its duties".
- The Defender may "obtain any information he deems necessary about the facts brought to his attention, without any claim of secrecy or confidentiality being made against him".
However, the exact scope of these provisions remains ambiguous. The penultimate paragraph of article 20 states that "persons bound by professional secrecy may not be prosecuted" for information revealed to the Human Rights Defender, "provided that this information falls within the latter's area of competence".
This wording does not explicitly lift banking secrecy, but creates immunity for those who violate it in favour of the Human Rights Defender.
5. Directorate-General for Consumer Affairs, Competition and Fraud Control (DGCCRF)
DGCCRF officials have extensive powers to obtain information covered by banking secrecy.
Article L.512-3 of the Consumer Code explicitly states that "professional secrecy may not be invoked against agents acting within the scope of the powers conferred on them by this book".
These agents can:
- Access to bank business premises between 8 a.m. and 8 p.m.
- Request all professional documents
- Gather the necessary information on site
The Court of Cassation has confirmed this prerogative, ruling that "professional secrecy and the protection of customers' personal freedoms cannot be invoked against investigators" (Cass. crim., 24 February 2009, no. 08-84.410).
In the specific case of relations between a credit institution and its customer, article L.317-1 of the French Monetary and Financial Code also allows DGCCRF officers to investigate and record breaches of provisions relating to general terms and conditions, bank charges or framework contracts for payment services.
Refusal to disclose is punishable by two years' imprisonment and a fine of 300,000 euros (article L.450-8 of the French Commercial Code).
Sources
- Code des juridictions financières: articles L.141-5, L.241-2
- Order no. 2022-408 of 23 March 2022 on the financial liability of public managers
- Social Security Code: Articles L.114-19 to L.114-21
- Circular DSS/2011/233 of 21 July 2011 on the conditions of application of the right of communication
- Conseil d'État, 30 December 2009, no. 306173, Société Experian
- Law no. 78-17 of 6 January 1978 on data processing, data files and individual liberties
- Constitutional Council, decision no. 2004-499 DC of 29 July 2004
- CNIL, Deliberation No. 2006-174 of 28 June 2006
- Organic Law no. 2011-333 of 29 March 2011 on the Human Rights Defender
- Consumer Code: article L.512-3
- Monetary and Financial Code: Article L.317-1
- Cass. crim. 24 February 2009, no. 08-84.410
EN 
FR