The CNIL (Commission Nationale de l'Informatique et des Libertés) is responsible for overseeing GDPR compliance in France. It has sanctioning powers that can reach four percent of global turnover or twenty million euros.

MiFID II strengthens investor protection by imposing the suitability assessment obligation. This means that investment firms must assess whether a product is suitable for the client's profile, including their knowledge, financial situation, and investment objectives.

Article L.511-4 of the Code monétaire et financier expressly provides for the applicability to credit institutions of Articles L.420-1 to L.420-4 of the Code de commerce, which prohibit anticompetitive agreements and abuse of dominant position.

The Cour de cassation did indeed condemn French banks in 2004 for collusion on mortgage loans, illustrating the application of competition law in the banking sector.

The GDPR and banking secrecy relate to client data protection. Anticompetitive agreements and abuse of dominant position fall under competition law.

Essential rights include the right to pre-contractual information, which obliges the provider to communicate clearly and comprehensibly all product characteristics, and the right of withdrawal, which allows the consumer to cancel the contract within fourteen days without penalty.

Banking secrecy, as defined in Article L.511-33 of the Code monétaire et financier, obliges credit institutions to maintain discretion regarding their clients' confidential information. This means they cannot disclose such information without the client's consent.

Directive (EU) 2023/2673 on the distance marketing of financial services provides that the consumer has a right of withdrawal allowing them to cancel the contract within fourteen days without penalty. This right has exceptions for services subject to market fluctuations, but the standard period is fourteen days.