Provisions specific to agreements entered into by electronic means do not contain
any specific rules for personal data protection because they are only the transposition
of European Directive no 2000/31/EC on electronic commerce.
Under article 1127-1 (1) of the Civil Code, “Anyone offering on a professional
basis by electronic means the supply of goods or services shall make the applicable
contractual provisions available in a way that enables them to be stored and copied”.
Paragraph 2 of the same article lists everything a contractual offer must contain and
especially the technical means for identifying any errors made in capturing data and
for correcting them.
Generally, French law on electronic communications has taken up the European
rules. However, there is a number of specifics.
The LIL recalls the rights of the “data subject” protected by GDPR.
55
The data subject must also be informed about the purpose of the processing and
the means they have to object to it.
56
Initially there was no need for a basis for processing in the LIL. It was only when
Directive 95/46 EC was transposed by the Act of 6 August 2004 that consent became
one of the bases for processing.
57
A reading of the former article 7 of the LIL might suggest that it is always
necessary to secure the consent of the data subject to set about processing personal
data.
58 However, this was not the case if the processing resulted from any of the
following five conditions:
1. Compliance with a statutory duty incumbent on the controller (e.g. to enable the
identification of content creators).
59
2. Saving the life of the data subject (e.g. data processing in healthcare).
3. Performing a public service mission incumbent on the controller or recipient (e.g.
laboratories
60 ; Comédie Française
61 ).
4. Performance either of a contract to which the data subject is party or of
pre-contractual measures taken at the request of the data subject.
62
5. Accomplishment of the legitimate interest pursued by the controller or recipient,
provided it does not disregard the interest or the fundamental rights and freedoms
of the data subject (e.g. a site for rating teachers does not constitute a legitimate
interest).
63
55 LIL, Article 1, Article 48 to Article 56.
56 LIL, Article 5 & Article 48.
57 Debet (2018), p. 37.
58 CNIL 23.07.2009, Deliberation no 2009-474 of 23 July 2009, JORF 19 August 2009, Text No
27, NOR: CNIA0900018X.
59 CE 20 November 2013, no 347349 about the Decree no 2011-219 of 25 February 2011.
60 For example: CNIL, Deliberation no 2012-408 of 22 November 2012. Decree no 2013-406 of
16 May 2013, “Outils de recherche de contamination ADN” (ORCA), JORF 18 May 2013, p. 8324.
61 CA Paris 19 June 2008, Juris-Data no 2008-370803.
62 CNIL, Deliberation no 2012-214 of July 19, 2012, Fnac Direct.
63 TGI Paris 3 March 2008, RG no 08/51650, Note 2 be, D. 2008, p. 288, note Manara; Comm., com.
électr. 2008, Comm. 58, Lepage.
166
L. Nicolas-Vullierme
any specific rules for personal data protection because they are only the transposition
of European Directive no 2000/31/EC on electronic commerce.
Under article 1127-1 (1) of the Civil Code, “Anyone offering on a professional
basis by electronic means the supply of goods or services shall make the applicable
contractual provisions available in a way that enables them to be stored and copied”.
Paragraph 2 of the same article lists everything a contractual offer must contain and
especially the technical means for identifying any errors made in capturing data and
for correcting them.
Generally, French law on electronic communications has taken up the European
rules. However, there is a number of specifics.
The LIL recalls the rights of the “data subject” protected by GDPR.
55
The data subject must also be informed about the purpose of the processing and
the means they have to object to it.
56
Initially there was no need for a basis for processing in the LIL. It was only when
Directive 95/46 EC was transposed by the Act of 6 August 2004 that consent became
one of the bases for processing.
57
A reading of the former article 7 of the LIL might suggest that it is always
necessary to secure the consent of the data subject to set about processing personal
data.
58 However, this was not the case if the processing resulted from any of the
following five conditions:
1. Compliance with a statutory duty incumbent on the controller (e.g. to enable the
identification of content creators).
59
2. Saving the life of the data subject (e.g. data processing in healthcare).
3. Performing a public service mission incumbent on the controller or recipient (e.g.
laboratories
60 ; Comédie Française
61 ).
4. Performance either of a contract to which the data subject is party or of
pre-contractual measures taken at the request of the data subject.
62
5. Accomplishment of the legitimate interest pursued by the controller or recipient,
provided it does not disregard the interest or the fundamental rights and freedoms
of the data subject (e.g. a site for rating teachers does not constitute a legitimate
interest).
63
55 LIL, Article 1, Article 48 to Article 56.
56 LIL, Article 5 & Article 48.
57 Debet (2018), p. 37.
58 CNIL 23.07.2009, Deliberation no 2009-474 of 23 July 2009, JORF 19 August 2009, Text No
27, NOR: CNIA0900018X.
59 CE 20 November 2013, no 347349 about the Decree no 2011-219 of 25 February 2011.
60 For example: CNIL, Deliberation no 2012-408 of 22 November 2012. Decree no 2013-406 of
16 May 2013, “Outils de recherche de contamination ADN” (ORCA), JORF 18 May 2013, p. 8324.
61 CA Paris 19 June 2008, Juris-Data no 2008-370803.
62 CNIL, Deliberation no 2012-214 of July 19, 2012, Fnac Direct.
63 TGI Paris 3 March 2008, RG no 08/51650, Note 2 be, D. 2008, p. 288, note Manara; Comm., com.
électr. 2008, Comm. 58, Lepage.
166
L. Nicolas-Vullierme