HL Chronicle of Data Protection : Privacy Lawyers & Attorneys : Hogan Lovells Law Firm : Data Security, E-Commerce & Technology

Turning specifically to the five areas of focus:

(i) definition of cloud computing: the CNIL suggests a definitional approach based on the main functional characteristics of various cloud computing services ;

(ii) role of the parties: the CNIL analyzes the role of the customer and service provider as data controller and data processor, respectively. According to the CNIL, the customer should always be regarded as a data controller. The role of the service provider might vary; the service provider could be a data processor or in some cases a co-controller.

(iii) applicable law:  one of the stickiest issues relates to applicable law. If the controller (in most cases the cloud customer) is established in France, French law would apply. But the situation is more complex where the controller is located outside of France and uses a cloud service provider with servers in France.  Note that in a March 2011 decision, the CNIL decided to exempt companies established outside the European Union and using processors based in France from notifying their processing when the processing relates the processing of human resources data or client and prospects data.

(iv) international transfers: most cloud services do not have a fixed location. Rules on international transfers of personal data are therefore difficult to apply. The CNIL suggests a two-fold approach, applying both legal and technical safeguards to international transfers. From a legal standpoint, the CNIL recommends the implementation of Standard Contractual Clauses in service providers' agreements, but also launches the idea of developing "Processor Binding Corporate Rules" or "Processor BCRs". Technically, service providers should apply security measures and data minimization (e.g. through the use of metadata) before data are transferred internationally;

(v) data security: the CNIL recommends the inclusion of security requirements in cloud computing agreements, while noting that customers are not always in a position to impose these requirements.

Interested parties have until November 17 to submit their comments. This consultation is an excellent way to enhance the French DPA’s understanding of cloud computing and propose technical solutions that may mitigate data protection risks.

The public consultation paper can be found (in French) here. 

First, the Court analysed the scope of the system. It noted that, while the system was presented as limited to the reporting of misconduct in the fields of accounting, finance, banking and corruption, it still allowed for reporting other matters. Indeed, even though the menus of the online interface did not contain references to the reporting of "matters of vital interest to the company" or "concerns,"  the homepage of the Ethics Point platform still indicated that it was designed to "report anonymously to the company any suspected bad behaviour or other problems" or "report matters on issues relating to compliance with our code of conduct and the online ethics policies". In addition and more importantly, the Court noted that the system as conceived still allowed any whistleblower to submit an alert with facts relating to any type of misconduct.

Consequently, the Court found that the system did not demonstrate the scope limitations applicable for French employees using the online interface but actually favoured "denunciations" of all sorts. Indeed, according to the Court, reports of concerns outside the scope of admissible concerns still have to be processed for filtering and then generate replies which "far from being limited to restating the categories of admissible concerns, incite the whistleblower to pursue the process through hierarchy".

In addition, the appellate judges considered that regardless of the fact that the company's internal rules expressly stated that "Stryker strongly recommends that users of the whistleblowing helpline identify themselves" the online interface did not discourage employees from remaining anonymous, "on the contrary, various recommendations are even made to preserve [such anonymity]".

Finally, the Court found that the documents provided to the employees did not provide them with sufficient information on their rights in the event that they were the subject of an investigation in this context.

In light of these elements, the Caen Appeal Court ruled that the system could damage the rights and collective and individual liberties of the employees of the company and therefore confirmed the suspension of the system.

The Court's approach appears to be extremely stringent and could require a number of international companies to further review the implementation of their whistleblowing helplines. In this respect, it is important noting that the Court's decision seems to go against the CNIL's position on the Benoist Girard case. Indeed, Benoist Girard had put forward, during the procedure, a letter from the CNIL which confirmed that their whistleblowing system had been inspected and appeared to be compliant with the requirements imposed by the CNIL. 

Thus, it appears the CNIL's position on whistleblower programs, in some instances, may not be sufficient to ensure full compliance with French data protection legislation.  A further appeal by Benoist Girard may be possible.

Pages Jaunes argued that the persons whose profiles were copied had been duly informed and consented, because the general terms and conditions of the social media sites indicate that information posted on public profiles may be accessible to search engines. 

The CNIL dismissed this argument. First, a number of the profiles that were being accessed were profiles of minors, and the informed consent of minors for this type of activity cannot be deemed to exist in these circumstances. Second, the reference to “search engines” in the social media sites’ general terms and conditions cannot be deemed to extend to companies whose principal activities are not that of a search engine. The CNIL pointed out that Pages Jaunes is a telephone directory and not a search engine. According to the CNIL, if the terms of use of the social media sites expressly mentioned that data in public profiles could be re-used by Pages Jaunes, that might constitute sufficient information and consent to allow Pages Jaunes to extract data from those sites. The CNIL pointed out that Pages Jaunes had entered into an agreement with one social media site called Trombi pursuant to which Trombi expressly mentioned on its site that data could be accessed and used by Pages Jaunes. For the major social media sites, however, no such agreement with Pages Jaunes existed. 

The CNIL also found that Pages Jaunes had breached its obligation to ensure that only accurate and updated data are processed. According to the CNIL, the profile data that was presented by Pages Jaunes was in many cases outdated by 4 to 12 months.

Pages Jaunes argued that it provided data subjects with the ability, on the Pages Jaunes website, to ask that their profile data not be accessed by Pages Jaunes, but the CNIL found that the procedures put in place by Pages Jaunes were too burdensome. A person must fill out a form and submit to Pages Jaunes proof of his or her identity for each social media site that the person wants to block. The CNIL also criticized Pages Jaunes for keeping logs of IP addresses and the time and date of queries made on the Pages Jaunes site. According to the CNIL, the retention of these data is excessive and not required under French law because Pages Jaunes is neither a telecommunications operator nor a hosting provider. Finally, the CNIL found that Pages Jaunes had violated its obligations with respect to the telephone directory data that it processes, because Pages Jaunes used that data to help refine the results of the social media profile searches. Under French law, universal directory providers are prohibited from using telephone directory data for any purpose other than providing a universal directory service. Pages Jaunes’s use of these data exceeded the scope permitted under French law.

The CNIL’s decision is a useful analysis of issues that are arising when collecting data publicly available on social media sites.

The issue of whose law will apply in the Cloud and the potential conflicts will be illustrated in an upcoming session at the IAPP Navigate program in Dallas on September 14, which was created and will be co-chaired by Hogan Lovells privacy practice director Chris Wolf and Michelle Dennedy, Chief Privacy Officer of McAfee, Inc. and Founder of The iDennedy Project.

From the IAPP, in its announcement of the Navigate conference:

Cloud computing involves data and data applications stored and processed remotely, often in places far away, sometimes in multiple places, and in places with differing legal regimes. Who has authority to prescribe and enforce rules about personal data in the cloud? When does law enforcement have the right to demand access to data in the cloud?

Decide these critical questions of jurisdiction and control in a “moot court,” where you will put cloud computing on trial and deliberate on the outcome. Provocateurs will portray opposing lead counsel in a hypothetical case involving a nation within the EU requesting a preliminary ruling from the European Court of Justice (ECJ) on whether a cloud computing company with a physical presence within its borders is subject to its enforcement of national data protection laws enacted under the EU Directive. Navigate participants will be split into two groups—counsel for the Petitioner and counsel for the Respondent. Five participants will be selected as "justices" who will be free to question "counsel" about their positions. The judges will have an opportunity to deliberate and will return to deliver a verdict when the group reconvenes.

For those who are interested, a copy of the Moot Court Hypothetical is available at www.privacyassociation.org (PDF).

May 16, 2011, a third party notified the CNIL of a data security breach at TMG. This triggered a security audit by the CNIL, which vulnerabilities in the TMG system, including insufficient procedures for updating computer facilities, faulty physical security measures, and the absence of any formal procedure for ensuring that security rules are applied in practice. The CNIL also found that TMG had failed to comply with its obligations to make notifications to the CNIL and had not put into place procedures to limit the period of time during which data are retained.

The CNIL issued a formal warning, giving TMG three months to correct all the measures of non compliance identified during the audit. The CNIL issued a press release on July 6, 2011 announcing the TMG audit and security deficiencies. The CNIL indicated in its press release that it had also issued a formal warning to the right holders who had entered into the contract with TMG. The right holders are the “data controllers” and are responsible for ensuring that their subcontractor TMG complies with data security obligations under French law. The CNIL has substantially increased the number of audits it conducts, and  the audits are often triggered after a third party notifies the CNIL of security breaches.

Evolution of formalities

In 2010, the CNIL decided to take a steep turn in the management of formalities which any data controller has to comply with in France. In France, unless a limited number of exceptions apply, any processing of personal data must either be declared or authorized by the CNIL.

Until 2010, all such formalities had to be completed by submitting paper hard files. This system changed when the CNIL introduced new notification and request for authorization forms which were also made available for electronic filing. The CNIL has clearly taken a turn towards increased dematerialization of formalities with the obvious objective to reduce notifications or requests for authorizations in paper format to a minimum.

While filings using paper hard files are still possible, they are clearly not encouraged and the delays for the handling of paper submitted formalities now appear much longer than those for documentation submitted through the CNIL online interface.

The new forms which now have to be used have not fundamentally changed the obligations imposed on data controller. However, a couple of their features should be pointed out.

Firstly, the new form for the notification of a processing is a simplified version of the previous one. In this respect, it does not require anymore the listing of the exact types data actually processed by the data controller anymore (even through general categories of data still have to be listed). This modification however calls for greater attention for data controllers internally to ensure that they do know the extent of their processing.

The second feature worth mentioning concerns the data controller's undertakings. Now, the data controller, when submitting its notification or request for authorization has to certify that "the processing is conducted in accordance with the requirements" of French data protection legislation by ticking a box. This new wording potentially puts a greater level of liability on the data controller to ensure that, at all times, the processing is fully compliant with French law.

Finally, it should be underlined that practice to date has revealed that use of the online system offers a greater reactivity in the management of files and especially of requests for authorization. Such progress could only be welcomed. 

Recommendation on security measures

Even though it mentions the obligation for data controllers to implement appropriate technical and organizational security measures for the protection of personal data, French legislation does not provide for any instrument setting out the specific framework defining those measures deemed appropriate (as opposed, for instance, to Italy).

Fully aware of this void, the CNIL had already issued recommendations regarding security measures relating to health data or electronic votes. In order to further address this situation, the CNIL issued a "Guide on security" (.PDF) in October 2010.

This guide, divided in 17 sections, addresses various issues in the field of security, ranging from the management of outsourcing to maintenance, archiving, anonymization or encryption.
The CNIL's "Guide on security" should therefore progressively become a tool used to set a minimum standard for technical and organizational security measures required for the implementation of any processing of personal data subject to French law.

It should also be noted, in the same vein, that the CNIL adopted a working document on the issues potentially associated with the outsourcing of processing of data outside the European Union.

Modification of the whistleblowing general authorization

In 2005, the CNIL had adopted a general authorization for the implementation of whistleblowing systems in France. Indeed, given the potential risks perceived by the CNIL as associated with whistleblowing systems, French law requires that whistleblowing systems are subject to prior authorization by the CNIL. In order to address the majority of systems implemented by French companies in order to comply with the requirements of the Sarbanes-Oxley Act, the CNIL had issued a general authorization whereby all whistleblowing systems complying with its requirements were pre-authorized and only subject to the filing of a mere undertaking of compliance.

The general authorization only covered systems allowing the reporting of alleged misconducts in the fields of accounting, finance and banking. Due to an ambiguous paragraph included in the original version of the general authorization, it was however thought that, in cases where the vital interests of the company were at stake, the whistleblowing systems covered by the general authorization could be used. However, in 2009, the French Supreme Court denied this analysis and considered the terms of the general authorization as being restricted to the three main fields mentioned above.

In order to clarify this ambiguous situation and align with the position of the French Supreme Court, the CNIL revised, late in 2010, the terms of the original general authorization.

The new amended version of the general authorization (in French) now encompasses whistleblowing systems implemented for the reporting of potential frauds to accounting, auditing and banking rules but also intended at being used to fight against corruption. In addition, the CNIL deleted the misleading section which previously made reference to the potential protection of the vital interests of the company.

As previously, all other whistleblowing systems (having wider or different scopes, etc.) will still have to be individually authorized by the CNIL.

One can regret that the CNIL decided to opt for a conservative road and therefore expressly strictly limit the scope of the general authorization as described above. Given both the already existing limitations to such systems (requirement of subsidiarity, limitations on anonymity, etc.) and the practice of whistleblowing systems in France, one could have hoped that the CNIL could have broadened the scope of the general authorization to the protection of certain vital interests of the company or to legally sanctioned misconducts (e.g. discrimination, harassment, etc.).

Development of processes involving biometric data

Use of biometric systems is increasing sensibly in France and the CNIL's activity clearly reflects this trend. This has been evidenced by decisions involving both the use of fingerprints and palm-vein or finger-vein technology.

The use of fingerprints has been approved by the CNIL in February 2010 in the context of the provision of medical treatment. More specifically, the technology was used in connection with patients treated by radiotherapy in a hospital located in the north of France. The system was deemed acceptable in consideration of a number of factors. First, the CNIL noted the potential public health considerations connected with the potential misadministration of radiotherapy treatments. Indeed, the system is intended at identifying patients to ensure that they receive the radiotherapy treatment required and thus avoid medical errors. In addition, amongst the relevant elements to evaluate the appropriateness of the system, the CNIL mentioned the fact that use of the system was subject to prior informed consent of the data subject and that the biometric data was retained solely for the period of the treatment.

Another interesting element was the fact that the CNIL noted that as well as the fact that palm-vein or finger-vein could not be used in this specific case due to the alterations caused by the radiotherapy treatment.

This information is all the more relevant that the CNIL seems to be inclined to favour palm-vein or finger-vein technology over fingerprints or other biometric systems. The CNIL refers to these new biometric technologies as "no-touch" biometrics and considers that they raise less issues than older systems: such technologies do not involve "exterior" attributes of the data subject and cannot be collected without the data subject's knowledge (as opposed to fingerprints which can be collected without the data subject's knowledge on any object he or she touches).

This favourable analysis was evidenced in April 2010 by the CNIL's authorization of a payment system using finger-vein technology in connection with a no-contact payment card.

It should be noted that in both cases of biometric technology mentioned above, the CNIL only granted authorizations for experimentations, respectively for 1 year and 6 months. However, this underlines possibilities offered to providers and users of biometric technologies in France, provided, naturally, that appropriate security measures are implemented.

Controls, sanctions and case-law

In 2010, the CNIL has continued the development of the exercise of its controlling and sanctioning powers as previously announced.

In this respect, it showcased the variety of its powers by imposing, for instance:

- a warning, published on its website, of the leader in tuition services in France in consideration of the existence of illegitimate and "excessive" comments which appeared in its client database;

- the immediate and urgent suspension of a video-surveillance system allowing a company to constantly monitor its employees' activities;

- the suspension of a fingerprint access control system implemented by a company which had been denied the authorization to implement the system in 2007 in the absence of any security imperative;

- a €10,000 fine on two bailiff offices which had failed to comply with their undertaking to amend their processes of personal data taken after an initial control conducted by the CNIL;

- a €15,000 fine to a clothing retail company, which had been previously sanctioned in 2007 for similar facts, for the illicit sending of unsolicited advertising faxes.

French courts have also applied the provisions of data protection legislation. In September 2010, the Dijon Court of appeal held the termination of an employment contract as wrongful because the employer had failed to comply with data protection legislation. In this case, the employee had been dismissed because of an alleged use of the company's car for personal use. To evidence this fact, the employer had installed a geolocation tracking device in the vehicle without informing the employee of this processing and without declaring it to the CNIL. Both in first instance and in appeal, the dismissal was considered wrongful. In addition, the Court of appeal sentenced the employer to €1,000 in damages to the employee for "unfair performance of the employment contract".

On the other hand, it should also be mentioned that, late in 2010, the dismissal of an employee was found to be legitimate when grounded on the fact that said employee had posted derogatory comments about its employers and hierarchy on its Facebook wall. The posts being accessible to all on the person's Facebook profile, the Employment Tribunal did not consider that they should have been treated as private correspondence.

Finally, it should also be mentioned that the CNIL exercised its controlling powers in the wake of the collection of personal information by Google Streetview vehicles. Further to the disclosure of this information by Google on 14 May, the CNIL conducted an onsite control on 19 May. In the absence of satisfactory answers, on 26 May, the CNIL ordered Google to provide, within 7 days, all relevant and specific information regarding the information collected. This request was then met by Google on 4 June 2010. The CNIL investigations on this matter are still not closed to date.

Certification labels: one of CNIL's top priorities for 2011

When modified in 2004, French data protection legislation provided for the possibility for the CNIL to award labels to products or procedures aimed at ensuring protection of personal data.

Due to procedural impediments (the required implementation decree was never adopted), this power was never effectively used. However, thanks to the passing of a new law in 2009, the CNIL now can fully exercise this power and intends to make of the definition of the criteria and award of the first labels one of its main topics for 2011.

The CNIL intended to have the first labels awarded to training and auditing services in the first quarter of 2011. It seems that keeping up with this calendar will be extremely difficult for the CNIL. Indeed, even though consultations on the matter with training and auditing services providers have started, the final version of the methodology, content and format of the services eligible for labels have not been communicated yet.

In a second step, the CNIL intends to award its labels to software providing a satisfactory degree of protection to personal data.

The development of these certification labels will therefore be one of the main topics to be followed upon over the coming year in France. This new project could become of interest for companies in the longer run. Indeed, with increased awareness of the requirements of data protection and privacy in the general public, a product or service enjoying the benefit of a CNIL certification label might gain a competitive advantage over others.