Skip to main content

Posts

CNIL’s decision against Google relating to the use of cookies: result of the appeal before the French Conseil d’Etat

On 4 March 2021, the French Conseil d’Etat rendered its decision in the Google vs CNIL case. As a reminder, on 7 December 2020, the CNIL imposed a sanction on Google LLC and Google Ireland Limited (together “ Google ”) for a total amount of 100 million euros for breach of Article 82 of the French Loi Informatique et Libertés (the “ LIL ”) relating to the use of cookies and other tracking technologies (Article 82 transposes Article 5.3 of the ePrivacy Directive). The CNIL found in particular that Google failed to obtain proper consent from data subjects, breached its information obligation and did not provide an efficient objection mechanism, in relation to the use of cookies. The CNIL also issued an injunction ordering Google to comply with article 82 of the LIL within three months, the CNIL being able to impose a €100 000 daily fine in case of non-compliance with such injunction. Google appealed the CNIL’s decision, by way of interim proceedings, in order to obtain the suspension
Recent posts

Proposition de règlement sur les marchés numériques ou Digital Markets Act (« DMA ») et Proposition de règlement sur les services numériques ou Digital Services Act (« DSA ») : principales dispositions

La publication des propositions de règlements DMA et DSA intervenue le 15 décembre 2020 constitue une étape importante de l’ambitieuse réforme de l'espace numérique envisagée par la Commission européenne. Dans le cadre du processus législatif européen, ces propositions doivent maintenant être soumises à l’approbation du Parlement et du Conseil qui leur apporteront probablement des amendements. Le délai moyen pour l’adoption d'un règlement est de 18 mois mais peut être significativement allongé pour des textes très discutés ou controversés ce qui sera vraisemblablement le cas du DMA et du DSA, compte tenu de leur vaste champ d’application, de l’importance des acteurs concernés ainsi que des pouvoirs conséquents qu’ils prévoient de conférer à la Commission.  La présente note donne un aperçu de la structure et des principales obligations applicables aux " gatekeepers ", dans le cas de la DMA (Partie I) et aux fournisseurs de " intermediary services " en ligne,

CNIL’s sanctions against Google LLC and Google Ireland Limited and against Amazon Europe Core: summary and main findings

 On 10 December 2020, the CNIL made public two decisions regarding the use of cookies in breach of Article 82 of the French Loi Informatique et Libertés (the “LIL”), which transposes the ePrivacy Directive 2002/58/EC (“ePrivacy Directive”). The first sanction, against a Google LLC and Google Ireland Limited (together “ Google ”) was for a total amount of €100 million (€60m for Google LLC and €40m for Google Ireland Limited, or “GIL”). The other sanction was imposed on Amazon Europe Core (“ Amazon ”) for €35m.  Set out below is a summary of both decisions, with a specific focus on the arguments and reasoning relating to the CNIL’s competence to enforce the provisions of the LIL against Google and Amazon, which is the subject of substantial and interesting developments. The two decisions have a number of points in common, although some of the interesting nuances are noted in our summary.  1. Background In relation to Google, the CNIL conducted an online audit of google.fr on 16 March 20

Adoption of the Law Regulating the Exploitation of the Image of Children Online

  Following our post regarding the draft Law Regulating the Exploitation of the Image of Children Online dated June 19, the French National Assembly finally adopted the text at second reading on October 6, 2020. The National Assembly has not made any changes to the Senate’s version, considering that the amendments made by the Senate (which watered down the provisions from the initial proposition) had made the provisions “more effective and provided a clarified legal framework”. The points of uncertainty that we raised in our initial blog post are therefore still relevant and will certainly need to be clarified in the upcoming months, either by the competent authorities or by the courts in the context of legal action. The law was promulgated on 19 October and published the following day. It will come into force in April 2021. A decree has yet to be issued by the French Council of State, in particular to set the income or duration thresholds at which the broadcasting of the imag

Le CEPD publie des lignes directrices sur le ciblage des utilisateurs de réseaux sociaux

Le 2 septembre 2020, le Comité Européen de la Protection des Données (CEPD) a adopté des lignes directrices sur le ciblage des utilisateurs de réseaux sociaux, qui sont ouvertes à la consultation publique jusqu'au 19 octobre 2020.   I.                    Contexte   Les réseaux sociaux permettent des échanges massifs de données à caractère personnel. Le ciblage publicitaire fait partie du business model des fournisseurs de réseaux sociaux, qui traitent les données personnelles issues de leur(s) plateforme(s) seuls ou conjointement avec d’autres acteurs.   Le CEPD, conscient des enjeux majeurs relatifs au traitement de données à caractère personnel dans le cadre du ciblage publicitaire sur les réseaux sociaux, a publié des lignes directrices afin de donner un cadre à ce ciblage publicitaire. Il demande principalement aux différents acteurs qui traitent des données de déterminer de manière transparente leurs rôles et responsabilités dans le cadre d'un contrat.   C

French Senate Adopts Law Regulating the Exploitation of the Image of Children Online

This post has been updated :  https://legalnews.bredinprat.tech/2020/10/adoption-of-law-regulating-exploitation.html Following adoption by the Senate last week, France is a step closer to  adopting a law  that will regulate the commercial exploitation of the image of children under the age of sixteen on online video-sharing platforms.  The law creates new obligations for online platforms, including by extending their data protection obligations. The current version of the law has been watered down from the initial proposition in relation to video platforms. Key provisions are the following: -    (i) The law extends an existing legislative framework regarding the treatment of revenues generated by young entertainers to children under 16 who appear online, for profit.  Employers of these children (and parents are included in this category) will be required to obtain prior authorisation and approval from the relevant prefect before engaging a child to a

The prohibition of cookie walls set out in the French regulator (CNIL) guidelines censored by the French Council of State

On 19 June 2020, the French “Conseil d'Etat” issued a decision in which it annulled a section from guidelines issued by the French data protection regulator (the “CNIL”) regarding the legality of the use of so-called ‘cookie walls’. The impugned section suggested that the practice of blocking the content of a site or application to a person who does not consent to the use of cookies is unlawful. The other provisions of the guidelines were validated by the Conseil d'Etat. On 4 th July 2019, the CNIL adopted deliberation No 2019-093 relating to the use of cookies and other online trackers. The deliberation constitutes formal guidelines and was issued as part of a larger CNIL action plan regarding targeted advertising, which was announced on June 28, 2019. The guidelines provide the CNIL's interpretation of applicable law in this area, recalling that a failure to comply may result in sanctions and it also sets out recommendations of good practice for the operators c