France - Electronic Identification Service (2022-676)

Overview

The Decree No. 2022-676 of 26 April 2022 authorises the creation and operation of the Service de garantie de l'identité numérique (SGIN), a processing system implemented jointly by the Minister of the Interior (secretariat general) and the Agence nationale des titres sécurisés (ANTS). The SGIN enables holders of a French national identity card containing an electronic component (CNIe) to use a mobile application on an NFC-capable terminal to read that component, to create a secure electronic identification/authentication means, and to generate attestations with a selectable subset of identity attributes to present to public or private third parties. The decree entered into force on 28 April 2022 and replaces the prior mobile-authentication measure created by Decree No. 2019-452. ([justice.pappers.fr](https://justice.pappers.fr/loi/JORFTEXT000045667825?utm_source=openai))

Definitions

Key defined concepts in the decree include: 'SGIN' (Service de garantie de l'identité numérique) — the authorised automated personal-data processing; 'CNIe' — the national identity card with an electronic component as referenced in the decree of 22 October 1955; 'application' or 'means of identification electronic' — the user-installed mobile application on an NFC-capable terminal; 'user' — the holder of a CNIe who voluntarily creates and uses the electronic means; 'FranceConnect' — the national federated login/identity hub which may receive certain data from SGIN under the conditions described by the decree. The decree also specifies categories of personal data, transaction metadata, and recipient categories for lawful processing. ([justice.pappers.fr](https://justice.pappers.fr/loi/JORFTEXT000045667825?utm_source=openai))

Governance and Institutional Framework

The decree establishes joint responsibility for implementation and operation between the Ministry of the Interior (secretariat general) and the ANTS. Responsibilities include development, deployment, operation, security, and maintenance of servers and the application ecosystem. Access to stored data is restricted to individually designated and specially authorised agents within the Ministry and the ANTS charged with project management and operation. The decree also requires publication of the up-to-date list of teleservice providers conventionally linked to FranceConnect and those linked by convention to the Ministry/ANTS to which specific identity attributes may be transmitted. Execution and enforcement are assigned to the Minister of the Interior. This governance framework positions SGIN as a public-regulated digital identity infrastructure designed to integrate with existing national services such as FranceConnect and complement broader governmental digital-identification projects. ([justice.pappers.fr](https://justice.pappers.fr/loi/JORFTEXT000045667825?utm_source=openai))

Key Focus Areas

The decree concentrates on several operational and legal axes: (1) lawful basis and scope of personal-data processing — listing permitted identity attributes and card metadata; (2) user autonomy and minimisation — the user may choose which attributes to disclose in generated attestations; (3) security and access control — access limited to designated staff and secured servers; (4) interoperability with national teleservice infrastructures — notably FranceConnect and convention-linked providers, subject to attribute-limited transmission; (5) data retention and logging — operational actions and transaction metadata are recorded and retained (three-year retention for operation logs); (6) rights of data subjects — the decree expressly references exercise of information, access, rectification and limitation rights under the EU GDPR; and (7) territorial application — the decree applies across metropolitan France and overseas territories with particular local adaptations (e.g., NC Connect in New Caledonia). These focus areas reflect a balance between enabling high-assurance digital identification and ensuring data-protection safeguards. ([justice.pappers.fr](https://justice.pappers.fr/loi/JORFTEXT000045667825?utm_source=openai))

Implementation Framework

Operationally, the decree authorises reading of specified personal data from the electronic component of the CNIe (excluding biometric fingerprint images) via NFC, generation of attestations via the user’s application, and transmission to approved recipients. The application lifecycle (creation, consultation, use, revocation, deletion) must be recorded with the actor identifier, timestamp and purpose; such logs are retained for three years on servers managed by the responsible authorities. Interfacing with third parties is controlled by convention; FranceConnect and convention-bound teleservice providers may receive limited attribute sets as defined by the decree. The ANTS is actively procuring implementation and operational contracts to realise and maintain SGIN, and budgetary planning and public procurement notices indicate multi-year IT and security programmes to support the service. ([justice.pappers.fr](https://justice.pappers.fr/loi/JORFTEXT000045667825?utm_source=openai))

Monitoring and Evaluation

The decree requires that access be limited to named and authorised personnel and that operational logs be kept for three years, available to those personnel on user request or in case of dispute. The listing and publication of authorised teleservice providers and conventions create a transparency mechanism for recipients. Monitoring responsibilities lie with the Ministry of the Interior and the ANTS; data-protection supervision and enforcement remain under the EU GDPR framework and the French Data Protection Authority (CNIL). Procurement and budget documents referenced by the government describe ongoing oversight, maintenance and security activities supporting SGIN. These monitoring arrangements are designed to enable audits, incident investigations and compliance checks. ([justice.pappers.fr](https://justice.pappers.fr/loi/JORFTEXT000045667825?utm_source=openai))

Penalties, Liability, and Appeals

The decree itself sets operational and access limits rather than bespoke criminal penalties; processing is explicitly subject to data-subject rights under Regulation (EU) 2016/679 (GDPR), and enforcement of data-protection obligations (including potential administrative sanctions) falls within the CNIL’s competence under applicable EU and national law. Operational errors, unlawful access, data breaches or violations of the GDPR could therefore engage administrative fines and corrective powers available to the CNIL; contractual liability and internal disciplinary measures are expected to be governed by ANTS and Ministry arrangements and public procurement contracts. The decree provides for user-requested access to operational logs and for their consultation in case of disputes, thereby creating procedural avenues for administrative review and evidentiary obligations for the operators. ([justice.pappers.fr](https://justice.pappers.fr/loi/JORFTEXT000045667825?utm_source=openai))

Relationship to Other Instruments

The decree expressly abrogates Decree No. 2019-452 of 13 May 2019 (which authorised the earlier “Authentification en ligne certifiée sur mobile”) and references the decree of 22 October 1955 regarding the national identity card. It also operates within the normative frameworks of the EU eIDAS Regulation (Regulation (EU) No 910/2014) for electronic identification and trust services and the EU General Data Protection Regulation (Regulation (EU) 2016/679) for personal-data protection. Connections to national initiatives such as FranceConnect and the broader France Identité programme are explicit in government planning and budget documentation. The decree therefore functions as a national implementing measure enabling integration of the CNIe-based identification into federated services and national digital-identity strategies. ([vlex.fr](https://vlex.fr/vid/decret-n-2022-676-902363477?utm_source=openai))

International Alignment

The SGIN is designed to be compatible with the EU-level eIDAS framework by allowing a CNIe-backed means of high-assurance identification and by enabling integration with services that may interoperate across EU member states under eIDAS principles. Budgetary and programme documentation frames SGIN/France Identité as part of a national strategy to meet eIDAS assurance levels and to provide a sovereign, interoperable identity solution for both domestic use and (where applicable) for cross-border interactions aligned with EU rules. The decree also contemplates application to overseas territories with local adjustments, and subsequent procurement and technical specifications have referenced EU interoperability and cybersecurity standards. ([budget.gouv.fr](https://www.budget.gouv.fr/files/uploads/extract/2023/PLR/BG/PGM/354/FR_2023_PLR_BG_PGM_354_JPE.html?utm_source=openai))

Implementation Timeline

Sources and References