French Consumer Law is a comprehensive and comparative overview of French and EU law in this field, covering: advertising, unfair commercial practices, conditions for the validity of contracts, unfair terms, product conformity, latent defects, product safety.

French Consumer Law

According to the CNIL (Commission nationale de l'informatique et des libertés) , whether online or through mobile applications, users of online communication services are tracked by various operators (publishers of online services, advertising management agencies, social media etc.) which analyze their online behavior, track their movements and their browsing and purchasing habits notably in order …

Targeted advertising and protection of personal data

According to the CNIL (Commission nationale de l'informatique et des libertés) , whether online or through mobile applications, users of online communication services are tracked by various operators (publishers of online services, advertising management agencies, social media etc.) which analyze their online behavior, track their movements and their browsing and purchasing habits notably in order to direct targeted advertising at them or offer them customized services., In its report of 26 March 2009 on online targeted advertising, the CNIL,  identifies three types of targeted advertising: “personal” or “personalized” advertising, “contextual advertising” and “behavioral advertising”. 

Behavioral advertising uses the profiling of users' behavior over time . According to which web pages users consult or which websites they visit, preferences they express on social media  or queries they make in search engines, tailored advertisements adapted to their profile are provided.

Contextual advertising is advertising that is selected based on the editorial content of pages being viewed or keywords entered in a search engine. The ads displayed are intended to reflect the interests of the internet user (e.g. ads for childcare equipment on a site dedicated to new parents).

Personalized advertising is “[…] selected on the basis of the known characteristics of users (age, gender, contact information, etc.) and that they have provided themselves, for example by subscribing to a service”. This type of advertising is in fact subject to the rules relating to the protection of personal data which, in essence, requires identification. On the other hand, as the other forms of targeted advertising do not require the identification of specific individuals, but rather the building of consumer profiles which are more or less reliable depending on the method used, the application of the provisions relating to personal data raises some issues.

The protection of personal data is the subject of various European legal instruments . 

In European law a general regulation aimed at reinforcing the rights of natural persons in respect of the protection of personal data (providing, inter alia, an effective right to be forgotten in the online environment) while at the same time enhancing trade opportunities (by facilitating the free flow of data within the Digital Single Market): General Data Protection Regulation No 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, known as the “GDPR”, has now been adopted . The GDPR is accompanied by guidelines on transparency , consent  and data breach notifications . 

In French law, the most important legislation is the Law on Information Technology, Data Files and [Civil] Liberties of 6 January 1978 (Information and Liberties law) , which was substantially modified by Law No 2018-493 , Decree No 2018-687 , Ordinance No 2018-1125  to bring French law into line with the GDPR and transpose the data protection directive “for police and criminal justice” , and the LCEN Law of 21 June 2004 and Ordinance No 2001-1012 of 24 August 2011. 

The concept of personal data is defined in Article 4(1) of the GDPR: “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject)” . The provision adopts a broad conception of identity that is not limited to a person's name alone, but concerns any means of directly or indirectly identifying the individual .

Thus, according to the CNIL, the European data protection authorities which came together within the Article 29 Data Protection Working Party  , the CJEU   and CNIL , one of such means of identification is the IP address which locates the user's computer .  The same applies, according to recital 30 of the GDPR, to technical cookies, referred to in Article 5(3) of Directive 2002/58  which makes them subject to an “opt-in” system by which the user or subscriber's consent is required before cookies can be used  .

Under French law, Article 82 of revised Law No 78-17 provides that “any subscriber or user of an electronic communications service must be informed in a clear and comprehensive manner, unless previously informed, by the data controller or his representative: - of the purpose of any action to access, by means of electronic transmission, to information previously stored in electronic communications devices, or to record data in that device ;  - of the means available to it to object thereto”. Such access or recording of data may only take place if the subscriber or user has expressed, after receiving said information, their consent through the appropriate parameter settings of the connection device or any other device under their control. These provisions are not applicable if access to the information stored in the terminal of the user or the recording of information in the user's device: either, has the exclusive purpose of allowing or facilitating electronic communication; or, is strictly necessary for the provision of an online communication service at the user's express request".

While the e-Privacy Regulation intended to replace Directive 2002/58 on the protection of privacy in the electronic communications sector has still not been adopted , on 17 September 2020, the CNIL adopted,  guidelines relating to the mandatory collection of consent from individuals  , completed by a recommendation on the use of cookies and other trackers  .

The guidelines cover the read and write operations of any information stored or consulted in a terminal device  regardless of the operating systems or application software used and whether or not it is personal data within the meaning of the GDPR. They concern the use of HTTP cookies, through which read and write actions are most often performed, but also other technologies such as “local shared objects” or “Flash cookies”, “local storage” implemented within the HTML standard, identifications by calculation of the terminal's fingerprint or “fingerprinting”, identifiers generated by operating systems, whether or not they are used for advertising purposes, hardware identifiers (MAC address, serial number or any other device identifier), etc.  After recalling that, in accordance with the exceptions provided for in Article 82 of Law No 78-17, the consent requirement does not apply to operations the sole purpose of which is to enable or facilitate communication by electronic means or which are strictly necessary for the provision of an online communication service at the express request of users, the guidelines draw up a list of tracking cookies that may be considered as exempt from the requirement to obtain consent:

- trackers that preserve users' expressed choice about cookies; 

- trackers intended for authentication to a service, including those intended to ensure the security of the authentication mechanism, for example by limiting robotic or unexpected access attempts; 

- trackers intended to keep track of the contents of a shopping cart on a merchant site or to bill the user for the product(s) and/or service(s) purchased; 

- personalization of the user interface (for example, for the choice of language or the presentation of a service), when such personalization constitutes an intrinsic and expected element of the service; 

- trackers that allow load balancing of equipment involved in a communication service; 

- trackers that allow paying sites to limit free access to a sample of content requested by users (predefined quantity and/or over a limited period) and;

- trackers enabling audience measurement provided that they are essential to the proper functioning of a website or an application and thus to the provision of a service ; to be included in this category, these trackers must not allow the global tracking of the navigation of an individual who is using various applications or browsing various websites; moreover, they must only serve to produce anonymous statistical data, and the personal data collected cannot be cross-referenced with other processing or transmitted to third parties. 

The guidelines specify, with respect to consent, that users must consent to the placing of trackers by expressing their willingness to do so “in a free, specific, informed and unambiguous manner, through a clear positive statement or act”. Simply browsing a website or using a mobile application does not constitute a clear and positive act of consent. Similarly, consent cannot be validly obtained to read and write operations by a global acceptance of general terms of use. In the case of processing operations serving different purposes, the user's consent must be sought for each separate purpose. For the user, refusing a tracker must be as easy as accepting it, bearing in mind that refusal can be deduced from the user's silence or inaction. Furthermore, it must be possible to withdraw consent at any time. The CNIL considers notably that consent can only be valid if the person concerned is able to exercise his or her choice validly and does not suffer major inconvenience in the event of the absence or withdrawal of consent . The informed consent of the user implies not only that he knows the identity of all the stakeholders using the trackers subject to consent, but also that he/she is clearly informed of the aims of the trackers, of the consequences of refusal or acceptance and of the right to withdraw consent. 

The recommendation, which outlines the guidelines, is addressed to all organizations that use trackers. In particular, it states that the purposes of the trackers (used for personalized advertising, audience measurement, geolocated advertising, sharing on social networks, etc.) must be formulated in an intelligible manner, in appropriate language and sufficiently clear to allow users to understand precisely what they are consenting to. With respect to trackers that are exempt from consent, the CNIL recommends that users be informed of their existence and purpose; in particular, for audience measurement cookies, the CNIL recommends that the lifetime of these cookies be limited to a period that allows for a relevant comparison of audiences over time and that they not be automatically extended with each visit, and that the information collected through these trackers be kept for a maximum of 25 months .

2) Processing of personal data and delisting

Article 4(2) of the General Data Protection Regulation defines data processing as any operation or set of operations which is performed on personal data  or on sets of personal data, whether or not by automated means, such as  collection, recording, organization, structuring, storage, adaptation or  alteration, retrieval, consultation, use, disclosure by transmission,  dissemination or otherwise making available, alignment or combination,  restriction, erasure or destruction . 

As search engines store personal data to increase their performance, the Court of Justice was asked for a preliminary ruling on whether such storage constituted processing of personal data. The ECJ answered in the affirmative by establishing a right to be removed from search lists i.e. delisted) ("right to be forgotten") for any internet user making such request to the operator of a search engine . According to the Court, the results displayed by the search engines following a search made on the basis of a person’s name constitute the processing of personal data, for which those operators are regarded as the “controller”. Such processing is subject to EU law on the protection of data insofar as the operator of the search engine has an establishment on the territory of the Union in order, inter alia, to ensure the promotion and sale of advertising space. The Court adds that the organization and aggregation of information published on the internet that are effected by search engines with the aim of facilitating their users’ access to that information may, when users carry out their search on the basis of an individual’s name, result in them obtaining through the list of results a structured overview of the information relating to that individual that can be found on the internet, enabling them to establish a more  detailed profile of the data subject. As a result, individuals may ask for information linked to their identity to be removed, subject to certain conditions, in particular, the interest of the public in having that information. Where the search engine refuses to remove data as requested, the person concerned may apply to the CNIL or the competent judicial authority to challenge that decision. The Article 29 Data Protection Working Party has also adopted Guidance to ensure a harmonized application of the Court's ruling . Strictly interpreting this decision, the CNIL considers that delisting must be carried for the whole of the search engine regardless of the country extension (.fr, .uk, .com etc.) . The Court of Justice ultimately declared that where a search engine operator grants a request for dereferencing, that operator is required to carry out that dereferencing on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States from gaining access, through the list of results displayed following that search, via a “non-EU” version of the search engine, to the links which are the subject of that request . The court of a Member State may even order a host provider to remove stored information the content of which is identical to the content of information which was previously declared to be illegal, or to block access to that information worldwide within the framework of the relevant international law . According to the Court of Cassation, the court hearing an application for deletion is required to make an assessment of its merits and to balance the interests involved, i.e. on the one hand the legitimate interest of internet users potentially interested in having access to information when carrying out research on the name of the applicant and, on the other hand, rights to respect for private life and the protection of personal data. A court cannot therefore issue a general injunctive measure rendering automatic the deletion of a list of results, displayed after a search of the name of a person, of links to web pages containing information about that person .  In thirteen rulings handed down on 6 December 2019, the Council of State clarified the boundaries of the right to be forgotten .

According to the Court of Justice, while the mere fact of making use of a social network such as Facebook does not make a Facebook user a controller jointly responsible for the processing of personal data by that network, the administrator of a fan page hosted on Facebook, by creating such a page, gives Facebook the opportunity to place cookies on the computer or other device of a person visiting its fan page, whether or not that person has a Facebook account and, by his definition of parameters depending, inter alia, on the target audience and the objectives of managing and promoting its activities, is involved in the processing of personal data of visitors to the fan page. Further, where the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of those establishments complies with the obligations laid down by the national law applicable .

In France the  “Information and Liberties” Law lays down a number of requirements applicable to personal data, in particular concerning their processing, collection and storing (Article 4)  and determines the conditions under which personal data processing is considered lawful (Article 6) . The CNIL's task of regulating the implementation of data processing is set out in Article 19 and the sanctions and corrective measures applicable in the event of an infringement of the GDPR or the law are detailed in Articles 20 to 23. Articles 31 and 32 allow some processing of personal data carried out on behalf of the State, authorized by order of the competent minister(s), or by decree approved by the Council of State, taken after a reasoned opinion is published by the CNIL. 

The CNIL  carefully oversees compliance with those provisions  and in particular, to the combined application of the GDPR and the Law of 6 January 1978. On its website, the CNIL states that “A good understanding of the legal framework implies combining both the national and European levels henceforth. The GDPR is directly applicable in French law: it replaces the French law on a number of points (rights of persons, legal basis of processing, security measures to be implemented, transfers, etc.)”.  The French legislature had adopted a “Law for a Digital Republic” , which included a personal data portability right, i.e. the right to obtain the personal data recorded when registrations or operations on the internet are carried out, and a right to “digital death”, a sort of digital will, regarding the fate of data published online in the event of a person's death, as well as a right to be forgotten for minors, who will be able to demand the deletion of data published about them before they reach legal adulthood. The right to data portability as interpreted by the French legislature conflicted with the GDPR and has been repealed by Article 33 of Law 2018-493, with the French Information Technology, Data Files and Civil Liberties ("Information and Liberties") Law now specifying that the right to data portability is exercised under the conditions laid down in Article 20 of the Regulation. The CNIL added that: “On other points (the "national margin of maneuver"), the French law remains in force and supplements the GDPR. This applies, for example, to the processing of health-related data or data on criminal convictions, the fixing of the age of consent for online services at 15 years' old, provisions relating to digital death, etc.”. Finally, the French law remains fully applicable for all “repressive” matters, whether in the criminal sphere or in the field of intelligence and national security. There are a number of special provisions in those matters "(Article 3, Law 78-17) .   

National Commission for the protection of personal data and individual liberties.

To track users, behavioral advertising uses “cookies”. 

Decree No 2018-687 of 1 August 2018, enacted in application of Law No 78-17 of 6 January 1978 on information technology, data files and civil liberties, amended by Law No 2018-493 of 20 June 2018 on the protection of personal data, OJ 177 of 3 August 2018.

Ordinance No 2018-1125 of 12 December 2018 enacted in application of Article 32 of Law No 2018-493 of 20 June 2018 on the protection of personal data amending Law No 78-17 of 6 January 1978 on information technology, data files and civil liberties and various provisions concerning the protection of personal data, OJ 288 of 13 December 2018. Article 29 of the Ordinance specifies that the modifications will come into force concomitantly with the future decree, amending Decree No 2005-1309 of 20 October 2005, which will be enacted under the “Informatique et Libertés” law in its wording resulting from the present Ordinance by 1 June 2019.  The ordinance is subject to a ratification law, the draft of which must be tabled within six months of its publication.

Directive No 2016/680 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offenses or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JH (Police and Criminal Justice Directive, OJ L 119 of 4 May 2016. 

According to the Council of State, the notion of person concerned by the processing of personal data cannot be extended to that person's legatee: see Cons. d'Ét., 8 June 2016, LawLex201600001736JBJ.

According to the GDPR, “an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

Article 29 of Directive No 95/46 entitled Working Party on the Protection of Individuals with regard to the Processing of Personal Data, stipulates that 1. a Working Party on the Protection of Individuals with regard to the Processing of Personal Data, hereinafter referred to as “the Working Party”, is hereby set up. It shall have advisory status and act independently. 2. The Working Party shall be composed of a representative of the supervisory authority or authorities designated by each Member State and of a representative of the authority or authorities established for the Community institutions and bodies, and of a representative of the Commission. Each member of the Working Party shall be designated by the institution, authority or authorities which he represents. Where a Member State has designated more than one supervisory authority, they shall nominate a joint representative. The same shall apply to the authorities established for Community institutions and bodies. 3. The Working Party shall take decisions by a simple majority of the representatives of the supervisory authorities. 4. The Working Party shall elect its chairman. The chairman's term of office shall be two years. His appointment shall be renewable. 5. The Working Party's secretariat shall be provided by the Commission. 6. The Working Party shall adopt its own rules of procedure. 7. The Working Party shall consider items placed on its agenda by its chairman, either on his own initiative or at the request of a representative of the supervisory authorities or at the Commission's request". Regulation No 2016/679 (Articles 68 - 76) now also establishes a European Data Protection Board (EDPB) to arbitrate disputes between the various competent European authorities and to develop a “European” doctrine on the protection of personal data.

CJEU Case C-582/14 Brey v Bundesrepublik Deutschland, Judgment of 19 October 2016, LawLex201600001711JBJ: a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

In Deliberation No 2013-378 of 5 December 2013, the CNIL found that the forms of access and registrations covered by Article 32-II “generally involve the processing of personal data, sometimes directly identifiable data (e.g., an email address), and often indirectly identifiable data (e.g., the unique identifier by a cookie, an IP address, the identifier of a terminal or a component of the terminal of the user, the result of "fingerprinting”, or even the ID generated by a piece of software or an operating system").

Although at first undecided, the French courts soon aligned themselves to the position of the EU courts: an IP address constitutes personal data, see TGI Saint Brieu, 6 September 2007, LawLex201500001029JBJ and CA Rennes, 28 April 2015, LawLex201500001799JBJ; Cass. civ. 1re, 3 November 2016, LawLex201600001808JBJ, but see CA Paris, 12 December 2007, LawLex201500001028JBJ: an IP address, if it constitutes personal data, only identifies a computer and not really a person, when it gives no indication as to his identity or his place of residence.

Directive No 2002/58, Article 5(3): “Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user”.

Before the entry into force of Amending Directive No 2009/136, the opt-out system prevailed where internet users could only object once the cookies were installed on their devices.

For an example of infringement see Deliberation No 2016-204 of 7 July 2016 imposing a fine on the company, Brandalley, LawLex201600001376JBJ.

Cf. proposal for a regulation of the European  Parliament and of the Council concerning the respect for private life  and the protection of personal data in electronic communications and  repealing Directive 2002/58/EC (Regulation on Privacy and Electronic  Communications) published by the Commission on 10 January 2017 (COM(2017)0010 – C8‑0009/2017 – 2017/0003(COD))

Deliberation No. 2020-091 of 17 September 2020 adopting guidelines on the application of Article 82 of the amended Law of 6 January 1978 to read and write operations on a user's terminal (in particular “cookies and other trackers") and repealing Deliberation No 2019-093 of 4 July 2019 adopting guidelines on the application of Article 82 of the amended Law of 6 January 1978 to read or write operations on a user's terminal (in particular "cookies and other trackers"), https://www cnil.fr/sites/default/files/atoms/files/lignes_directrices_de_la_cnil_sur_les_cookies_et_autres_traceurs. pdf: the amended guidelines of 17 September 2020 were adopted to take into account the decision of the Council of State of 19 June 2020, LawLex202100000147JBJ, essentially validating the guidelines of 4 July 2019, with the exception of the general and absolute prohibition of the practice of "cookie walls” which, according to the Court of Cassation could not be included in an act of “soft law”.

The Guidelines of 4 July 2019 repealed Deliberation No 2013-378 of 5 December 2013 adopting a recommendation on cookies and other trackers referred to in Article 32-II of the Law of 6 January 1978, LawLex201500001030JBJ, which has now been replaced by Deliberation No 2020-092 of 17 September 2020 adopting a recommendation proposing practical methods of compliance in the event of recourse to “cookies and other trackers,” https://www.cnil.fr/sites/default/files/atoms/files/recommandation-cookies-et-autres-traceurs.pdf.

The guidelines refer to Article 1 of Directive No 2008/63/EC of 20 June 2008 on competition in the markets in telecommunications terminal equipment which defines terminal equipment as  “equipment directly or  indirectly connected to the interface of a public telecommunications network to send, process or receive information; in either case (direct or indirect), the connection may be made by wire, optical fibre or electromagnetically; a connection is indirect if equipment is placed between the terminal and the interface of the network” , This definition includes, according to the CNIL, tablets, smartphones, desktop or laptop computers, video game consoles, connected televisions, connected vehicles, voice assistants, as well as any other terminal equipment connected to a telecommunications network open to the public.

According to the CNIL, trackers whose purpose is limited to measuring the audience of the site or application, to meet various needs (performance measurement, detection of navigation problems, optimization of technical performance or ergonomics, estimation of the power of the servers required, analysis of the content consulted, etc.) are strictly necessary for the functioning and day-to-day administration of a website or application and are therefore not subject, pursuant to Article 82 of the French Data Protection and Liberties Law, to the legal obligation to first obtain the user's consent.

In its guidelines, the CNIL states that the validity of consent is subject to the condition that the data subject does not suffer any major inconvenience in the event of the absence or withdrawal of consent, “such a major inconvenience may consist in the impossibility of accessing an internet site due to the practice of “cookie walls” which consists of blocking access to a website or mobile application for those who do not consent to the depositing or reading, on their terminal, of connection tracers.” However, according to the Conseil d'Etat, by inferring a general and absolute ban on the practice of cookie walls from the sole requirement of free consent set forth by the RGPD, the CNIL exceeds its powers as it is an instrument of soft law, Cons. d'Et., 19 June 2020, LawLex202000001859JBJ.

The Court of Justice has clarified that the information that the service provider must give to a website user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies: CJEU Case C-673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV,  Judgment of 1 October 2019, LawLex201900001157JBJ. 

Cf. French Law No 78-17, Art. 2 : “[...]  "any operation or set of operations concerning such data, whatever the process used, and in particular the collection, recording, organization, storage, adaptation or modification, retrieval, consultation, use, communication by transmission, dissemination or any other form of making available, matching or interconnection, as well as blocking, erasure or destruction constitutes the processing of personal data”.

Directive No 95/46 of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; Directive No 2002/58 of 12 July 2002 known as the “Directive on privacy and electronic communications”; Directive No 2006/24 of 15 March 2006, the “Data retention direction; the "Telecoms package” of 25 November 2009, composed of Directives No 2009/136 amending Directive 2002/22 on universal service and users' rights relating to electronic communications networks and services, Directive No 2002/58 on the processing of personal data and the protection of privacy in the electronic communications sector, Regulation No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws and Regulation No 2009/140 amending Directives 2002/21 on a common regulatory framework for electronic communications networks and services, 2002/19 on access to, and interconnection of, electronic communications networks and associated facilities, and 2002/20 on the authorization of electronic communications networks and services and Regulation No 1211/2009  establishing the Body of European Regulators for Electronic Communications (BEREC) and the Office. 

Case C-131/12 Google Inc. v Agencia Española de Protección de Datos, Judgment of 13 May 2014.

http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp225_en.pdf

In 2015 Google was subject to two public formal notices aiming at the compliance with that requirement,  http://www.cnil.fr/fileadmin/documents/approfondir/deliberations/Bureau/D2015-047_MED_GOOGLE_INC.pdf  http://www.cnil.fr/fileadmin/documents/approfondir/deliberations/Bureau/D2015-170_bureau_publicite_MED_GOOGLE_INC.pdf. In early 2016, Google relaxed its policy concerning the right to be forgotten and promised to delist the results of searches on all its sites provided that the search came from a European country. However, as Google only carried out the delisting for European geographical extensions of its search engine, so that the delisted content remain accessible on “.com” and non-European extensions, the CNIL imposed a fine of EUR 100 000 in its Deliberation of 10 March 2016, see https://www.cnil.fr/sites/default/files/atoms/files/d2016-054_sanction_google.pdf; see also Cons. d'Ét., 19 July 2017, LawLex201700002121JBJ, referring a question to the Court of Justice for a preliminary ruling as to whether the right to be delisted assumes that the operator of a search engine is required, when acceding to a request to delist, to do so for all the domain names in its search engine, so that the contested links no longer appear regardless of where the search of the applicant's name is carried out from, including outside the territorial scope of application of EU law. The CNIL again imposed a fine of EUR 50 million on Google for lack of transparency in its personal data protection policy and lack of valid user consent regarding the processing of their data for the purpose of advertising targeting, see Deliberation by limited panel No SAN - 2019-001 of January 21, 2019 pronouncing a financial penalty against the GOOGLE LLC, Communic. com. electr. 2019, No 35 and 43. 

CJEU Case C-507/17 Google LLC v  Commission nationale de l'informatique et des libertés (CNIL) Wikimedia Foundation Inc.; Fondation pour la liberté de la presse; Microsoft Corp.; Reporters Committee for Freedom of the Press and others;  Article 19  and others;  Internet Freedom Foundation and others, Judgment of 14 February 2019 LawLex201900001132JBJ, adding that the rights of the person demanding de-referencing override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to that person's, unless it appeared, for particular reasons, such as the role played by the person in public life, that the interference with his or her fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question.

CJEU Case C-18/18 Eva Glawischnig-Piesczek v Facebook Ireland, Judgment of 3 October 2019, LawLex201900001171JBJ.

Cass. 1re civ., 14 February 2018, LawLex201800000923JBJ.

Cons. d'Ét., 6 December. 2019, LawLex202000000286JBJ, clarifying that the right to be forgotten presupposes in principle that the CNIL, when asked by an individual to formally demand that a search engine operator de-references links referring to web pages published by third parties and containing personal data not falling under particular categories, will do so, unless, taking into account the right to freedom of information, there is an overriding public interest in having access to a such information from a search of the name of that person and that, in order to balance personal data protection with the right to freedom of information and assess whether it can legally defeat the right to be dereferenced, it is for the CNIL to take into account the nature of the information in question, its content, its objective nature, its accuracy, source, conditions and the date it was posted, the repercussions that its referencing is likely to have for the person concerned, but also the reputation of that person, their role in public life and their function in society, but also the possibility of accessing the same information from a search on keywords not mentioning the name of the person concerned and the role, if any, played by the latter in advertising given to the data concerning him/her;  LawLex202000000287JBJ: considering that the CNIL must grant the request for the delisting of links referring to an article citing the applicant because of the functions he exercises within the Church of Scientology, the maintenance of these links not being of preponderant interest for the public, insofar as the person concerned has not exercised said functions for more than ten years or any activity in connection with that organization, that the case reported in the press article had ended with an order for dismissal and as, moreover, interested internet users may, within the framework of a search carried out using keywords not mentioning the name of the interested party, continue to have access to it; LawLex202000000288JBJ: holding, on the other hand that the CNIL, hearing a request for the dereferencing of a link referring to an article giving a summary of the novel of the applicant, published in 2009, which was the subject of media coverage, and comprising a certain amount of personal information concerning him, all extracted from the book none of which falling into specific categories, is justified in finding that the overriding interest of the public in having access to this information from a search carried out of the name of the interested party precludes - despite its age and the fact that the work is no longer published - the granting of the request, having regard in particular to the fact that its accessibility comes from the literary activity of the person and taking into account the interest, for the public, to be able to access reviews of books published through a search of the name of authors; LawLex202000000289JBJ: upholding the CNIL's refusal to grant a request for the de-referencing of links referring to the web pages of two websites which, for the most part, merely repeat the remarks that the applicant herself chose to make during an interview of May 2018 granted to a third website about her conviction for acts of domestic violence pronounced by the Correctional Court of Versailles, despite the repercussions that their continuation is likely to have, when their referencing is strictly necessary for informing the public, having regard to the nature and content of the information at issue, its source, the conditions under which it is processed by the disputed web pages, the recent aspect of the interview and the fact that the person concerned has acquired a certain notoriety by playing one of the main roles in a series which continues to be broadcast;  LawLex202000000290JBJ: finding that the CNIL, in a request for the de-referencing of a link to a page of a website which reports on his activity as a general practitioner, specifies the coordinates of its surgery and gives the possibility to internet users to makes comments after a consultation, may refuse to grant the request, insofar as of on the date of the decision, no comments appear on the site in question and that, having regard to the nature and content of the data remaining accessible which only mention the professional activity of the applicant and provide her postal address and telephone number, it is in the overriding interest of the public to have access to this information via searches of her name.

Case C-210/16 Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Judgment of 5 June 2018, LawLex201800000866JBJ.

“Personal data must be: 1° processed lawfully, fairly and, for processing subject to Title II, transparent to the data subject; 2° Collected for specified, explicit and legitimate purposes, and not further processed in a way incompatible with these purposes. However, further processing of data for archival purposes in the public interest, for scientific or historical research purposes, or for statistical purposes is considered compatible with the original purposes of the data collection, if carried out in compliance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 and of this law, applicable to such processing and if it is not used to make decisions with regard to the data subjects”; 3° Adequate, relevant and, in the light of the purposes for which they are processed, limited to what is necessary or, for processing referred to in Titles III and IV, not excessive; 4° Accurate and, if necessary, kept up to date. All reasonable steps must be taken to ensure that personal data which is inaccurate, having regard to the purposes for which they are processed, is erased or rectified without delay; 5° Stored in a form allowing the identification of the persons concerned for a period not exceeding that necessary for the purposes for which they are processed. However, personal data may be stored beyond this period as long as it is processed exclusively for archival purposes in the public interest, for scientific or historical research purposes, or for statistical purposes. The choice of data preserved for archival purposes in the public interest is made under the conditions provided for in Article L. 212-3 of the French Heritage Code; 6° Processed in such a way as to ensure adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, or access by unauthorized persons, using appropriate technical or organizational measures".

“Processing of personal data is only lawful to the extent that it fulfills at least one of the following conditions: 1° Where the processing falls under Title II, it has received the consent of the person concerned , under the conditions mentioned in Article 4 (11) and Article 7 of Regulation (EU) 2016/679 of 27 April 2016 mentioned above; 2° The processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the request of the latter; 3° The processing is necessary for the fulfillment of a legal obligation to which the controller is subject; 4° The processing is necessary to safeguard the vital interests of the person concerned or another natural person; 5° Processing is necessary for the execution of a mission of public interest or falling within the exercise of the public authority of which the controller is invested; 6° Except for the processing carried out by the public authorities in the performance of their duties, the processing is necessary for the legitimate interests pursued by the controller or by a third party, unless the interests or freedoms and fundamental rights of the data subject which require protection of personal data, in particular where the data subject is a child”.

The GDPR (OJ L 119 of 4 May 2016, 1-88) repeals Directive No 95/46 / EC. It is applicable per Article 99 (2) from 25 May 2018.

Revised Law No 78-17 states at Article 8: “In particular, the CNIL: - informs all persons concerned and all data controllers of their rights and obligations and may, for this purpose, provide adapted information to local authorities, their groupings and small and medium-sized enterprises; ensure that the processing of personal data is carried out in accordance with the provisions of this Law and other provisions relating to the protection of personal data provided for in the laws and regulations, the law of the European Union and the international commitments of France; - give an opinion on the processing referred to in Articles 31 and 32. - draw up and publish guidelines, recommendations or standards designed to facilitate compliance with the processing of personal data (...).”

As an example see Decision No 2016-026 of 26 January 2016, LawLex201600000267JBJ, by which the CNIL issued a formal notice asking Facebook to comply with the Information Technology and Liberties law within three months, including fairly collecting the browsing data of internet users who do not have Facebook accounts and to allow its subscribers to object to the compilation of their data for the purposes of targeted advertising.

Law No 2016-1321 of 7 October 2016, OJ of 8 October 2016.

Revised Law No 78-17 states at Article 3, “I. - Without prejudice, as regards processing falling within the scope of Regulation (EU) No 2016/679 of 27 April 2016 to the criteria laid down in Article 3 of that Regulation, all the provisions of the present Law apply to the processing of personal data carried out in the context of the activities of an establishment of a data controller or a subcontractor on the French territory, whether or not the processing takes place in France. II. -The national rules adopted on the basis of the provisions of the same regulation which confers on national law the task of adapting or supplementing the rights and obligations provided for by the Regulation apply where the person concerned resides in France, including when the data controller is not established in France. However, where one of the types of processing referred to in point 2 of Article 85 of the same Regulation is involved, the national rules referred to in the first subparagraph of II are those which apply to the controller when established in the European Union”.

Guidelines on Transparency under Regulation 2016/679 (WP 260rev.01).

Guidelines on Consent under Regulation 2016/679 (WP 259)

Guidelines on Personal data breach notification under Regulation 2016/679 (WP 250).

Amended, inter alia, by Law No 2004-801 of 6 August 2004 on the protection of natural persons in respect of the processing of personal data.

Law No 2018-493 of 20 June on the protection of personal data, OJ 141 of 21 June 2018.

French Consumer Law

79. Targeted advertising and protection of personal data

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

79. Targeted advertising and protection of personal data

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise