Who: Commission des Clauses Abusives (Abusive Clauses Commission, the “ACC”)
Where: France
When: December 2014
Law stated as at: 3 December 2014
What happened:
Social media is now so ingrained within our culture that it is listed in the Oxford Dictionary as a verb as well as a noun. With the use of social media becoming increasingly widespread, regulators and courts in the EU are becoming progressively more vigilant in their approach to the privacy practices and site use policies of social media platforms.
In this vein, the ACC, a consultative body established under the French Consumer Code, has published an opinion (“Opinion”) on compliance of social media policies with French consumer and privacy legislation. It identifies 46 clauses currently appearing in social media terms of use and privacy policies that it considers to be unfair and potentially in violation of applicable laws. The publication is significantly longer than a 140-character tweet.
Just a few of the ACC’s recommendations
Amongst the 46 clauses listed as being unfair, a number of those are privacy-specific provisions. For example, the Opinion states that:
– clauses which provide that certain information (e.g. IP addresses) is not personal data are contrary to French data protection laws; and
– if and to the extent that sensitive personal data is being processed, it must be done with the express consent of the consumer; a clause providing that the mere usage of the website amounts to consent would be unfair.
Additionally and importantly, the Opinion makes a number of recommendations which are not privacy-specific. Again, by way of example:
– it considers that policies will not be clear and understandable (as required by consumer protection laws) where they contain insufficient or excessive cross-referencing between policy documents; and
– it recommends that statements made to the effect that use of social network services are free, when in fact the service is provided in exchange for the platform’s ability to use the consumer’s data to sell advertising, would also be unfair.
Why this matters:
Whilst the opinion of the ACC is not binding on courts or on the French consumer protection agency, it has persuasive authority. Perhaps worryingly for social media providers, it suggests that EU consumer protection authorities – as well as data protection regulators – should also be involved in the regulation of online privacy policies, terms of use and cookie policies.
