On 31 December 2021, the restricted committee of the French Data Protection Supervisory Authority (“CNIL”) (i) fined Facebook Ireland 60 million euros and Google a total of 150 million euros (i.e., 90 million euros for Google LLC and 60 million euros for Google Ireland Limited) for failing to allow the users of facebook.com, google.fr and …
On 16 November 2021, the French data protection supervisory authority (the “CNIL”) published a practical guide (“Guide”) on Data Protection Officers (“DPOs”). The Guide provides a reminder of the applicable obligations regarding the designation, tasks and missions of DPOs as well as good practices to help organizations comply with their obligation to designate a DPO …
France: The CNIL publishes a practical guide on Data Protection Officers Read More »
Every year, the French supervisory authority (the “CNIL”) publishes its key priorities for upcoming dawn-raids. In 2021, more than 50% of the CNIL’s dawn-raids will focus on: (i) websites cybersecurity, (ii) health data protection and (ii) cookies. 1. Websites cybersecurity Website security incidents are among the most common non-compliances identified by the CNIL during its …
The CNIL’s key priorities for upcoming dawn-raids in 2021 Read More »
By Denise Lebeau-Marianna – Partner and Yaël Hirsch – Senior Associate The French Supervisory Authority (the “CNIL”) has issued new updated guidelines on data retention during the month of July (the “CNIL’s Guidelines”)[1]. They provide more practical guidance and update the CNIL previous Recommendations dated 11 October 2005 on the conditions of archiving personal data[2]. …
On 28 July 2020, the French Supervisory Authority (the “CNIL”) sanctioned the online shoes retail company, SPARTOO SAS, by a €250,000 fine and an injunction to comply with GDPR within 3 months under penalty for various non-compliances with the GDPR of the personal data processing related to clients, prospects and employees[1]. I. Factual background and …
Denise Lebeau-Marianna, Partner & Alexandre Balducci, Associate – DLA Piper France LLP Further to two complaints filed by non-governmental organisations None Of Your Business (NOYB) and La Quadrature du Net (LQDN), the French data protection supervisory authority (CNIL) restricted committee imposed on January 21, 2019 a EUR 50 million administrative fine against Google LLC for …
By Denise Lebeau-Marianna (Partner) & Alexandre Balducci (Associate) Why did the CNIL adopt a specific regulation for the use of biometric data processing in the workplace? In accordance with Article 9 (4) of the General Data Protection Regulation (GDPR) which provides that “Member States may maintain or introduce further conditions, including limitations, with regard to …
FRANCE: THE FIRST CNIL STANDARD REGULATION FOR BIOMETRIC SYSTEMS IN THE WORKPLACE Read More »
By Patrick Van Eecke, Denise Lebeau-Marianna, Tiphaine Caulier and Laetitia Mouton Under European data protection law, journalists enjoy some regulatory exemptions when processing personal data for journalistic purposes, balancing the right to the protection of personal data with the principle of freedom of expression. A question which has however sparked some debate is whether so-called citizen …
By Denise Lebeau-Marianna and Caroline Chancé On 31 January 2019, the French Data Protection Supervisory Authority (CNIL) and the French General Directorate for Competition Policy, Consumer Affairs and Fraud Control (DGCCRF, authority in charge of consumer protection) signed a new protocol of cooperation to improve protection of personal data of consumers. This new protocol replaces a …
FRANCE: New cooperation agreement between the CNIL and DGCCRF Read More »
By Denise Lebeau-Marianna, Caroline Chancé and Alexandre Balducci On 21 January 2019, the restricted committee of the French Data Protection Supervisory Authority (CNIL) fined Google LLC 50 million euros for breaching GDPR for lack of transparency, inadequate information and lack of valid consent regarding personalized advertising. This is the first decision rendered by the CNIL …
By Denise Lebeau-Marianna and Yaël Hirsch On 12 December 2018, the French Government issued an ordinance[1] finalizing, at the legislative level[2], the alignment of the French Data Protection Law (“FDPL”) with the General Data Protection Regulation[3] (“GDPR”) and the Directive 2016/680[4]. Following-up the adoption of the GDPR, the French Law No. 2018-493 related to personal data protection[5] …
FRANCE: ONE MORE STEP TO ENSURE CONSISTENCY OF THE NEW FRENCH DATA PROTECTION LAW Read More »
By Denise Lebeau-Marianna and Tiphaine Caulier The French Data Supervisory Authority (the CNIL) released guidance on December 28th 2018 on the principles to be followed when an organization that collects personal data through online or hard copy forms, shares it with business partners or data brokers to send SMS or emails for marketing purposes. To comply …
FRANCE: CNIL PUBLISHES GUIDANCE ON DATA SHARING FOR MARKETING PURPOSES Read More »
On 8 November 2018, French NGO Internet Society France sent Facebook a formal notice listing seven areas where it has allegedly infringed GDPR. The social network has 4 months to respond. Failing that, the Internet Society France could launch the first class action suit for compensation since the entry into application of GDPR. The French …
FRANCE: Facebook could face a 100 million euros class action suit for violating GDPR Read More »
By Denise Lebeau-Marianna and Caroline Chancé On September 29, 2017, the French data protection authority (the CNIL) published practical guidance on General Data Protection Regulation (“GDPR”) requirements intended for data processors. The objective is to guide them on how to comply with their new obligations. Under the GDPR, data processors have new responsibilities and liabilities in …
