Written commercial agreement

Significant imbalance

Sudden termination of established relationships

Competition investigation – French law

Civil competition action

French competition law

Competition investigation – European law

European competition law

Vertical restraints

Distribution law

Liability for defective products

Consumer law

Prohibition of measures having equivalent effect

European business law

Corruption

Compliance

Economic law

Shareholders' agreements

Removal of company directors

Abuse of voting rights

Companies

Action for infringement (counterfeiting)

Rights conferred by the trademark

Patentability

Industrial property

Commercial rent review

Renewal of the commercial lease

Despecialization (change of use)

Commercial leases

Reform of contract law

Reform of the law of special contracts

Preliminary sales agreement

Obligation to deliver goods in conformity

Classification of the contract for services (contrat d'entreprise)

Effects of the agency agreement with respect to third parties

Business contracts

Ongoing contracts

Recovery claims

Court-approved transfer plan

Bankruptcy proceedings

Personal data breaches

White collar crime

Commercial law

500 Questions - Business Law

Security measures protecting the server containing personal data, including restricting access to only those who must be authorized, must be implemented. An undertaking fails to meet its obligations regarding IT security when access to the server containing personal data is not subject to any satisfactory access restriction measures, nor to logging, which could allow for the detection of actions p …

What security measures do companies need to implement?

The preliminary formalities refer to a set of declarative formalities to be completed with the CNIL before implementing a personal data processing operation. Depending on the processing, this involves a declaration or a request for authorization (Articles 31 to 36 of the Law of 6 January 1978), with the data controller required to be able to establish compliance with the rules of the General Data Protection Regulation (GDPR) at any time, particularly regarding the traceability of procedures (principle of accountability).

The act, including through negligence, of processing personal data without complying with the prior formalities provided by the law of 6 January 1978 is criminally sanctioned, without requiring a threshold of data or files to be exceeded . Automated processing can take different forms . As soon as it is likely to exclude individuals from the benefit of a contract or service, the processing falls under the authorization regime .

Article 226-16 of the Criminal Code does not condition the preliminary formalities for the implementation of personal data processing on the execution of operations with specific technicality. Indeed, even when the operations consist solely of using simple functionalities, limited to classification and archiving, without implementing any particular automation or technical rules for extraction or dissemination, a prior declaration obligation may arise . The act of processing or having processed personal data without complying with the preliminary formalities required by law, even through negligence, is punishable by five years of imprisonment and a fine of 300,000 euros. The temporary or permanent limitation of processing, its prohibition, or the withdrawal of an authorization granted under the regulation or the law may also be pronounced by the president of the CNIL, when the data controller or its processor does not comply with the obligations resulting from the GDPR or the law.

Courts cannot infer from the fact that a secretary's personal directory, admittedly insufficiently secured, in which notes concerning a staff member were recorded, was not intended to host other notes concerning other service agents, that a personal data file has been created.

Cass. crim., 8 September 2015, LawLex202200002465JBJ.

The defendant, who did declare by mail the launch of a website but did not return the declaration form sent by the CNIL, must be declared guilty of processing personal data without having complied with the prior formalities for their implementation.

CA Lyon, 25 February 2004, LawLex202200005082JBJ.

The establishment of a system allowing each of the user doctors and their secretaries to access the medical information contained in the files created by other doctors does not constitute the offense under Article 226-17 of the Criminal Code, as the doctors, bound by professional secrecy, cannot be considered unauthorized third parties within the meaning of this Article.

Cass. crim., 30 October 2001, LawLex202200002493JBJ.

The implementation by a company of automatic detection and automated control of each profile during registration or in the course of use, in its database, constitutes a breach of the provisions of Article 25-I, 4° of the law of 6 January 1978, which states that automated processing likely, due to its nature, scope, or purposes, to exclude individuals from the benefit of a right, a service, or a contract, is implemented after authorization from the CNIL, in the absence of any legislative or regulatory provision, whereas such processing falls under the authorization regime.

CNIL, 24 June 2015, LawLex202200003560JBJ.

The prior formalities for the implementation of personal data processing are not subject to the execution of operations of specific technicality, within the meaning of Article 226-16 of the Criminal Code.

Cass. crim., 23 May 2018, LawLex202200003591JBJ.

What are the preliminary formalities for the use of personal data?

The controller of personal data processing is, in principle, the person, public authority, company, or body that determines the purposes and means of the processing and decides on its creation. In practice, it is generally the legal entity (undertaking, community, etc.) represented by its legal representative (president, mayor, etc.).

Any person who orders or carries out the processing of personal data undertakes, with respect to the individuals concerned, to take all necessary precautions to ensure the security of the information and, in particular, to prevent it from being distorted, damaged, or disclosed to unauthorized third parties. This concerns not only the individuals who are personally the subject of the processing of personal data but also all those who may be directly or indirectly affected by the exploitation of this processing. Thus, a data controller is the person responsible for the processing of personal data of a financial institution, subject to banking secrecy . Super administrators, who have access to data protected by professional secrecy and who act within the scope of their activity as IT consultants to ensure the operation of software that processes personal and confidential data and whose employment contract includes a confidentiality clause, cannot be considered unauthorized third parties.

The data controller of a financial institution, subject to banking secrecy, who must commit to taking all necessary precautions to ensure the security of the information and prevent it from being altered, damaged, or disclosed to unauthorized third parties, cannot merely state that they will send the CNIL proof of the tests conducted “prior to the IT switch.”

CNIL, 3 June 2004, LawLex202200003564JBJ.

Who is the data controller?

Security measures protecting the server containing personal data, including restricting access to only those who must be authorized, must be implemented. An undertaking fails to meet its obligations regarding IT security when access to the server containing personal data is not subject to any satisfactory access restriction measures, nor to logging, which could allow for the detection of actions performed on this server.

The failure of a company in IT security can also result from security defects due to repeated shortcomings, and not from an isolated error, as long as it should have ensured the security of the data in question at all stages, both during the reuse of the data for its internal project and upon the completion of its research project, even if they were caused by an employee, as long as the employee was acting on the company's instructions and on its behalf .

Security flaws that result not from an isolated human error but from repeated deficiencies characterize a company's failure in IT security that led to the violation of personal data, as the company should have ensured the security of the data in question at all stages, both during the reuse of the data for its internal project and upon the completion of its research project, even if they were caused by an employee, as long as the employee was acting on the company's instructions and on its behalf.

CNIL, 28 December 2021, LawLex202200002500JBJ.

The Criminal Code provides a set of scenarios which, when subject to automated processing, must be brought to the attention of the individuals concerned by the data controller and penalizes the failure to comply with this information obligation (Art. R. 625-10).

The information must, in particular, cover:

the identity of the data controller and, where applicable, that of its representative;

the purpose pursued by the processing for which the data are intended;

his rights of enforcement, inquiry, access, and rectification;

the purpose of any action aimed at accessing, by electronic transmission, information stored in its terminal connection equipment or at entering, by the same means, information in its terminal connection equipment;

The information provided by the company implementing the data processing must enable the user to give their consent to this processing in a specific, informed, and unambiguous manner . The information must be given directly to the data subject . It must specify the purposes of the processing, including the installation of cookies, and the rights available to the data subjects . The information must be visible, highlighted, and complete to allow only a determined, explicit, and legitimate purpose of the processing .

Advice: Do not submit all processing to the user's consent in a single block.

The feature, which allows the user to provide blanket consent for the processing of their data for various related purposes, cannot be considered compliant unless the different purposes are presented to the user separately.

The feature, which allows the user to give consent collectively for the processing of their data for different but related purposes, can only be considered compliant if the different processing purposes have been presented to them distinctly beforehand and they have been able to give specific consent for each purpose through a clear affirmative action, with boxes not pre-checked.

CNIL, 21 January 2019, LawLex201900000259JBJ.

People who downloaded a mobile application before the implementation of a tracker are not directly informed of its integration into the application and the purpose pursued by this processing, as when a new partnership is concluded with a company, the tracker is integrated into the user's smartphone during an application update if it has already been downloaded, without the new terms of use or privacy policies of the applications being directly brought to their attention.

CNIL, 25 June 2018, LawLex202200003576JBJ.

The person concerned by the collection of personal data is not able to express free, specific, and informed consent when the form allowing them to subscribe to a website's newsletters also gives them the option to agree, via a checkbox, to receive other newsletters without complete information on the scope of their consent, not knowing specifically how many and which newsletters they are subscribing to, as the form does not include any information regarding the implementation of personal data processing.

CNIL, 13 October 2014, LawLex202200003568JBJ.

The homepage of a website must inform users of the advertising purpose of some of the cookies placed, the possibility of changing cookie settings and the means available to refuse their placement, and the necessity of a positive action on their part to express consent to the placement of cookies.

CNIL, 24 June 2015, LawLex202200003562JBJ.

What is the scope of the obligation to inform individuals?

Individuals have a right of reply and may ask the data controller whether their personal data is being processed, for information related to the processing, the data processed and their recipients, the disclosure of data concerning them, as well as information that allows them to understand and contest the logic of automated processing in the event of a decision based on it producing legal effects.

Compliance with the right of access requires that a procedure for managing requests be defined and implemented to ensure their effective processing. Data controllers must therefore communicate to the requester, in an accessible form, the personal data concerning them  and cannot refuse to respond favorably to a request for access to a deleted account on a site or for which the member has unsubscribed .

The fact that the legal entity responsible for processing does not communicate to the person, in an accessible form, under the conditions provided for in Article 39 of the amended law of 6 January 1978, personal data concerning them is punishable by a fine of up to 7,500 euros.

A company cannot refuse to respond favorably to a request for access related to an account deleted from a site or for which the member has unsubscribed for more than 15 days, on the grounds that the data is archived.

CNIL, 24 June 2015, LawLex202200003570JBJ.

Under what conditions must the right of access to personal data be ensured?

Natural persons whose personal data is subject to automated processing have a right to information and a right of access, as well as the right to object to this use. It is not possible to proceed with the automated processing of data despite the objection of the natural person when this processing is carried out for commercial prospecting purposes or when the objection is based on legitimate grounds (Art. 226-18-1 Criminal Code). The objection in the case of data used for commercial purposes may not be based on legitimate grounds .

Opposition is not subject to any formal requirement. It is sufficient to address it to the CNIL. In all cases, the data controller must provide users with a mechanism to enforce opposition to the transmission of their personal data .

Advice: Provide for an enforcement mechanism that goes beyond account deletion.

A mechanism of enforcement based on the permanent deletion of an account does not ensure a fair balance between the interest of the company and the interest of the individuals concerned, as it results in depriving the person of the use of a service.

The condition of legitimacy of the grounds for enforcement is fulfilled, in political, philosophical, or religious matters, by the mere exercise of the ability, for the person concerned, to oppose the processing of personal data.

Cass. crim., 28 September 2004, LawLex202200003601JBJ.

The transmission of user data to a third party lacks a legal basis because the data controller fails to respect, in pursuing its legitimate interest, the interests and rights and freedoms of individuals by providing them with a mechanism to oppose the transmission of their personal data.

CNIL, 27 November 2017, LawLex202200003569JBJ.

To what extent can a natural person object to the use of their personal data?

The Criminal Code penalizes the act, outside the cases provided by law, of entering or retaining in computerized memory, without the express consent of the person concerned, personal data that, directly or indirectly, reveal racial or ethnic origins, political, philosophical, or religious opinions, or trade union memberships of individuals, or that relate to their health, sexual orientation, or gender identity, as well as entering or retaining in computerized memory personal data concerning offenses, convictions, or security measures (Art. 226-19 Criminal Code).

Consent can only be express if it is given with full knowledge of the facts . Users must be able to indicate their agreement by checking a box dedicated to the approval of the use of their sensitive personal data.

The Criminal Code also punishes the retention of data beyond the legal period, unless this retention is carried out for historical, statistical, or scientific purposes, or the processing of personal data retained beyond the legal period for purposes other than these .

When authorized, retention must be time-limited and not exceed the legal or set period, meaning a duration that does not exceed what is necessary for the purposes for which the information is collected and processed.

Advice: Provide for a cookie retention period limited to 13 months after the first deposit in the user's terminal equipment.

Consent can only be express if it is given with full knowledge, meaning after the provision of adequate information on the use that will be made of personal data, regardless of the option given to the internet user to check a box “I keep it to myself” or not to provide their data.

CNIL, 24 June 2015, LawLex202200003572JBJ.

The retention of client names, phone numbers, credit card numbers with expiration dates, as well as cryptograms, whose data can only be used and retained for the strict need and duration of a specific transaction and must not be stored, constitutes the offense of illegal data retention.

Cass. crim., 3 March 2015, LawLex202200003602JBJ.

What are the consequences of storing or maintaining sensitive data in a computerized system without the express consent of the individual concerned?

Article 226-22 of the Criminal Code punishes the act by any person who has collected, during their recording, classification, transmission, or another form of processing, personal data whose disclosure would harm the reputation of the person concerned or the privacy of their private life, by disclosing this information without the authorization of the person concerned to a third party who is not entitled to receive it, including when the disclosure is committed through carelessness or negligence.

The unintentional offense committed by recklessness or negligence under Article 226-22, para. 2, is punishable, for natural persons, by three years of imprisonment and a fine of 100,000 euros. For legal entities, pursuant to the combined Articles 226-22 para. 2 and 131-38, the penalty can reach a fine of 500,000 euros. Other offenses are sanctioned by five years of imprisonment and a fine of 300,000 euros for natural persons. Pursuant to Article 226-24 of the Criminal Code, for legal entities, these offenses are punishable by a fine that can reach 1,500,000 euros. In the case of multiple violations, the amount of the administrative fine, which cannot exceed the amount set for the most serious violation, may be set at 2% of the worldwide annual turnover when the offender has committed a breach of Articles 28, 32, and 34 of the GDPR.

500 Questions - Business Law

498. What security measures do companies need to implement?

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

498. What security measures do companies need to implement?

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise