Following French implementation of changes to the EU Privacy and Electronic Communications Directive, CNIL, the state data privacy law enforcer, has published guidance on how to obtain the obligatory consent to the use of technology that accesses or stores information on laptops, tablets, mobiles etc. Claire Bouchenard of the BCube law firm in Paris reports.
Topic: Online advertising
Who: The Commission Nationale de l’Informatiqueet des Libertés (CNIL)-the French Independent Administrative Authority protecting privacy and personal data
Where: France
When: 26 October 2011
Law stated as at: 24 November 2011
What happened:
According to Article 32-II of French Law n°78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, as amended by Ordinance n°2011-1012 of 24 August 2011:
“Any subscriber or user of an electronic communication service shall be informed in a clear and comprehensive manner by the data controller or its representative, except if already previously informed,regarding:
– the purpose of any action intended to provide access, by means of electronic transmission, to informationpreviously stored in their electronic connection terminal device, or to record data in this device;
– the means available to them to object to such action.
Such access or recording may only be carried out provided that the subscriber or user has explicitly expressed, after receiving said information, their agreement that may result from appropriate parametersettings in their connection device or any other system under their control.
These provisions shall not apply if the access to data stored in the terminal device of the user or the recording of information in the terminal device of the user is:
– either exclusively intended to enable or facilitate communication by electronic means; or
– strictly necessary for the provision of an online communication service at the user’s express request”.
On the 26 October 2011, the CNIL issued guidelines on the implementation of this article which state that the parameter (browser) settings in the user’s connection device are not a valid expression of his consent because:
– “The data subject’s consent shall mean any freely given specific and informed indication of his wishes” (Article 2(h) of the Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data),
– A connection device which would accept cookies in a general way without distinguishing in function of their purposes, will not allow the user to give a specific consent,
– A connection device which would ask for the user’s consent for each cookie will not allow the user to give a valid consent either because the user won’t be given clear and comprehensive information and because all cookies will be concerned even those which required no prior consent from the user.
Why this matters:
The CNIL guidelines indicate a different approach to the interpretation and enforcement of the new "cookie law" compared to some other European Union Countries.
For this reason, it is worth considering whether the French law as interpreted by CNIL would apply to websites on servers in for instance the UK which may drop cookies on French laptops, tablets, mobiles etc.
According to Article 5 of French Law n°78-17, this Law (which includes the new cookie laws) only applies if:
"1. the data controller is established on French territory. The data controller who carries out his activity on French territory within an establishment, whatever its legal form, is considered established on French territory;
2. the data controller, although not established on French territory or in any other Member State of the European Union, uses means of processing located on French territory, with the exception of processing used only for the purposes of transit through this territory or that of any other member State of the European Union”.
So it seems clear that French law will not apply to data controllers which are exclusively established in a Member State of the EU other than France, such as the UK. In this last case, UK cookie law is most likely to apply in our scenario,
Claire Bouchenard
Partner
BCube, Paris
Claire@bcube-avocats.fr
