Who: The French Data Protection Authority (CNIL)
Where: France
When: 12 March 2020
What happened:
The CNIL has just released its strategy for all its controls and investigations for 2020. It has announced that one of its three strategic priorities will concern cookies and other trackers and in particular marketing cookies and user profiling (alongside health data and geo-localisation used by consumer services mobile applications).
These three priorities have been identified as priorities by the CNIL because they target and affect the daily life of French people.
The CNIL has forecast that 20% of its controls and investigations in 2020 will concern these priorities, which would represent around 50 formal proceedings this year. The CNIL has already launched several investigations on major online advertising companies in order to:
- Ensure that companies using cookies or other tracking devices fully comply with the obligations of article 82 of the French law Informatique et Libertés to;
- Inform the user about the purposes for which the cookies placed;
- Obtain the user’s prior consent before placing cookies on the user’s device.
- Encourage companies to comply with (i) the CNIL guidelines published in July 2019 on cookies and other trackers and (ii) the draft recommendation to guide operators in the operational implementation of such new cookie requirements.
The guidelines and the recommendation are not in force yet. The CNIL will allow a period of six months from the publication of this recommendation for organisations to comply with the new obligations resulting from this legal framework. It should be noted that with regard to the adoption of its recommendation, the CNIL has postponed the timetable, which was initially scheduled for early April to an undetermined date in order to take into account the current Covid-19 health crisis.
The rest of the controls and investigations will depend on complaints and claims addressed to the CNIL. “Hot topics” include requiring the control of the data processing to be implemented and corrective measures (following a formal notices or sanctions, etc.) requiring new verifications and controls.
Why this matters:
The CNIL’s strategic priorities are major elements to be taken into account for companies insofar as controls and investigations will be reinforced in these sectors. Companies using cookies or other trackers must ensure their compliance and prepare for a possible CNIL action by documenting their compliance.
Inspections and action began in early 2020. However, due to Covid-19, on-site inspections are postponed until the end of the containment measures announced by the French government. Other controls (such as online monitoring) could be implemented by CNIL agents, remotely.
