Current case law regarding cookies Warning!

In our article Compliance of cookies and other trackers, we reminded you of the rules applicable to cookies and reported a sanction of 35 million euros pronounced by the CNIL in this regard.

Indeed, on December 7, 2020, the CNIL imposed a fine of €35 million against the company Amazon Europe Core, in particular for having placed advertising cookies on the computers of users of the “Amazon.fr” sales site without prior consent or satisfactory information. The Council of State validated this sanction on June 27, 2022.

For the record, article 82 of Law No. 78-17 of January 6, 1978 relating to data processing, files and freedoms, known as the “data processing and freedom law” which transposes Directive 2002/58/EC “privacy and electronic communications” (or “ePrivacy”) into French law, provides:

• “Any subscriber or user of an electronic communications service must be informed clearly and completely, unless previously informed by the data controller or his representative:
• 1° The purpose of any action tending to access, by electronic transmission, information already stored in one’s electronic communications terminal equipment, or to enter information in this equipment;
• 2° The means available to him to oppose it.
  These accesses or registrations can only take place on condition that the subscriber or user has expressed, after having received this information, their consent which may result from appropriate parameters of their connection device or any other device placed under their control.
  These provisions are not applicable if access to information stored in the user’s terminal equipment or the recording of information in the user’s terminal equipment:
• 1° Either, has the exclusive purpose of enabling or facilitating communication by electronic means;
• 2° Either, is strictly necessary for the provision of an online communication service at the express request of the user. »

With the entry into force of the General Data Protection Regulation (GDPR) on May 25, 2018, consent requirements have been strengthened, this text defining consent as “any manifestation of will, free, specific, informed and unambiguous by which the data subject accepts, by a declaration or by a clear positive act, that personal data concerning him or her are subject to processing. “.

Thus, the Council of State confirms the two violations of article 82 of the “Informatique et Libertés” law sanctioned by the CNIL: the deposit of cookies without prior consent and the faulty information of users.

In addition, the Council of State considers that the amount of the fine imposed by the CNIL (35 million euros!) is not disproportionate in view of the seriousness of the breaches, the scope of the processing and the financial capacity of the company.

Therefore, the LEGALPROTECH-AVOCATS firm can only invite you to check that your website has a cookies banner which must respect the prior nature of consent to the deposit of tracers, leave the possibility of accessing the service even in the event of refusal to consent (the now well-known “Continue without accepting”), and provide a device for withdrawing consent that is easy to access and use.