The panel indicates that it is misleading for social media platforms to tell consumers that the service is free. The contract should explain that the service is provided in exchange for the platform’s ability to use the consumer’s personal data to sell advertising. Privacy policies that state that IP addresses and browsing habits are not personal data are also unfair and misleading, according to the panel, because they diverge from the French legal definition of personal data. Many privacy policies do not define specific purposes for which personal data may be used. Because French data protection law requires that individuals are informed of the specific purposes for use, clauses of this kind are unfair, says the panel. The same applies to provisions that purport to authorize the platform to process sensitive data. Any processing of sensitive data requires a separate explicit consent from the individual. The panel identified provisions on onward transfers as another problem: Most privacy policies do not identify the third parties to whom personal data may be transferred and do not identify the purposes for which the third parties may use the data. Likewise, privacy policies often do not offer the individual a right to object to transfers of their data. These provisions are unfair, according to the panel.
Any provisions that do not impose a strict duration on the platform’s retention of personal data are unfair because they violate the principles of French data protection law. The same holds true for clauses that provide for the transfer of personal data outside the EU but don’t give the individual the possibility to provide a specific consent to the transfer. According to the panel, certain privacy policies shift the burden for keeping personal data secure to the individual. The panel states that the burden for protecting personal data lies principally with the platform, and that it is unfair to transfer this burden to the individual.
The panel’s opinion is not binding on courts or on the French consumer protection agency. However, the opinion has considerable persuasive authority, creating a presumption that the clauses identified in the opinion are unfair under French consumer protection law. The panel’s opinion shows that consumer protection authorities may become more involved in the enforcement of data protection laws, thus complementing the enforcement actions of the French data protection authority, the CNIL.