On 4 March 2021, the French Conseil d’Etat rendered its decision in the Google vs CNIL case.
Google appealed the CNIL’s decision, by way of interim proceedings, in order to obtain the suspension of the decision. The grounds for appeal mainly focused on the CNIL’s jurisdiction to act against the Google entities in France, given that Google’s lead supervisory authority in Europe is the Irish data protection authority..
Before the CNIL, Google had argued that the French data protection authority did not have jurisdiction since the GDPR procedural framework should apply, i.e. the one-stop-shop mechanism applicable to cross-border data processing activities..
The CNIL decided that the GDPR one-stop-shop mechanism did not apply and that it had subject-matter jurisdiction notably because (i) French law has given the CNIL jurisdiction to ensure compliance with Article 82 of the LIL which transposes the ePrivacy Directive, as well as to sanction any violation thereof, and (ii) the control of Article 5.3 of the ePrivacy Directive falls under the ePrivacy control mechanism, and not under that of the GPDR (and therefore the one-stop-shop mechanism).
In its decision of 4 March 2021, the Conseil d’Etat upheld the CNIL’s position and ruled that the French data protection authority had jurisdiction in the Google case. The Conseil d’Etat recalled that, while the GDPR consent requirements in relation to the use of certain cookies, interpreted in accordance with the ECJ decision in the Planet49 case, do not apply to the implementation and control of the ePrivacy Directive, which has its own specific enforcement mechanism. Indeed, the ePrivacy Directive enforcement mechanism is set out at article 15 a) of the Directive, and provides that Member States shall ensure that “competent national authorities, or other national organizations”, have authority regarding application of (notably) the Article 5.3 rules. According to the CNIL, as confirmed by the decision of the Conseil d’Etat, this provision excludes per se the one-stop-shop mechanism.
Google is therefore bound to respect the CNIL’s injunction to comply with Article 82 of the LIL. A proceeding on the merits is also ongoing in parallel before the Conseil d’Etat, and another decision will therefore be rendered by the Conseil d’Etat in this matter within a few months.