See above for the right of erasure of data of minors.
Apart from the LIL, the following provisions are applicable to marketing by
electronic means: article L. 34-5 and article R 10-1 of the CPCE, articles 226-1
et seq. and 226-16 et seq. of the Criminal Code
88 and a simplified standard no 48 of
the CNIL.
89
The protection covers natural persons only. The general rules on data processing
apply
90 : data collection must be fair
91 and done for specific purposes.
The data subject must have consented to treatment,
92 and the controller must be
pursuing a legitimate interest. There cannot be one single act of consent for two
separate instances of data processing.
93 Sensitive data are excluded from processing.
Files must respect the rights of persons in accordance of GDPR: information, the
right to object, the right of access, the right of rectification.
The rules applicable to individuals (BtoC) offer more protection than those
applicable to professionals (BtoB).
In BtoC relations, anyone in principle may object to marketing. The principle is
that it is prohibited to send marketing material by electronic means without the
addressee’s prior consent.
94 By consent the Act means “any display of free, specific
and informed wishes by which a person accepted that personal data concerning them
be used for direct marketing purposes”
95 (direct marketing is “the sending of any
message intended to promote directly or indirectly goods, services, or the image of a
person selling goods or providing services”). This opt-in principle includes two
exceptions: if the person is already a customer and the products or services proposed
are similar to those initially supplied and if the marketing is not commercial.
96 In any
event, the person concerned must be able at any time during collection to object
simply and free-of-charge to the use of their data.
The legislator has sought to strike a balance between knowledge of consumer
behaviour and protection of the private data of those same consumers.
In 2008, “the CNIL took the view that sending advertising messages to mobile
phones via Bluetooth technology should be tantamount to directing marketing by
electronic mail”.
97 This is not the solution that the Commission adopted.
88 CNIL, La publicité par voie électronique, October 2016: https://www.cnil.fr/sites/default/files/
atoms/files/_commerce-donnees_perso_publicite_electronique.pdf.
89 CNIL, Norme simplifiée no 48: adopted in 2005, modified in 2012 and 2016: Deliberation no
2016-264 of 21 July 2016: CNILTEXT000026268805. See Debet et al. (2015), pp. 938 ff.
90 LIL, Article 5 & Article 6.
91 CNIL, Decision of 21 September 2011: https://www.cnil.fr/sites/default/files/typo/document/
D2011-203_Pages_Jaunes.pdf. (Accessed on 21 September 2018).
92 See Bretonneau (2015), p. 1112.
93 CNIL, Decision No MED 2018-043 of 8 October 2018.
94 CPCE, Article L 34-5 § 1
er
.
95 CPCE, Article L 34-5 § 2.
96 CPCE, Article L 34-1-1, § 4.
97 Debet et al. (2015), p. 940.
Data Protection in the Internet: French Report
169
Apart from the LIL, the following provisions are applicable to marketing by
electronic means: article L. 34-5 and article R 10-1 of the CPCE, articles 226-1
et seq. and 226-16 et seq. of the Criminal Code
88 and a simplified standard no 48 of
the CNIL.
89
The protection covers natural persons only. The general rules on data processing
apply
90 : data collection must be fair
91 and done for specific purposes.
The data subject must have consented to treatment,
92 and the controller must be
pursuing a legitimate interest. There cannot be one single act of consent for two
separate instances of data processing.
93 Sensitive data are excluded from processing.
Files must respect the rights of persons in accordance of GDPR: information, the
right to object, the right of access, the right of rectification.
The rules applicable to individuals (BtoC) offer more protection than those
applicable to professionals (BtoB).
In BtoC relations, anyone in principle may object to marketing. The principle is
that it is prohibited to send marketing material by electronic means without the
addressee’s prior consent.
94 By consent the Act means “any display of free, specific
and informed wishes by which a person accepted that personal data concerning them
be used for direct marketing purposes”
95 (direct marketing is “the sending of any
message intended to promote directly or indirectly goods, services, or the image of a
person selling goods or providing services”). This opt-in principle includes two
exceptions: if the person is already a customer and the products or services proposed
are similar to those initially supplied and if the marketing is not commercial.
96 In any
event, the person concerned must be able at any time during collection to object
simply and free-of-charge to the use of their data.
The legislator has sought to strike a balance between knowledge of consumer
behaviour and protection of the private data of those same consumers.
In 2008, “the CNIL took the view that sending advertising messages to mobile
phones via Bluetooth technology should be tantamount to directing marketing by
electronic mail”.
97 This is not the solution that the Commission adopted.
88 CNIL, La publicité par voie électronique, October 2016: https://www.cnil.fr/sites/default/files/
atoms/files/_commerce-donnees_perso_publicite_electronique.pdf.
89 CNIL, Norme simplifiée no 48: adopted in 2005, modified in 2012 and 2016: Deliberation no
2016-264 of 21 July 2016: CNILTEXT000026268805. See Debet et al. (2015), pp. 938 ff.
90 LIL, Article 5 & Article 6.
91 CNIL, Decision of 21 September 2011: https://www.cnil.fr/sites/default/files/typo/document/
D2011-203_Pages_Jaunes.pdf. (Accessed on 21 September 2018).
92 See Bretonneau (2015), p. 1112.
93 CNIL, Decision No MED 2018-043 of 8 October 2018.
94 CPCE, Article L 34-5 § 1
er
.
95 CPCE, Article L 34-5 § 2.
96 CPCE, Article L 34-1-1, § 4.
97 Debet et al. (2015), p. 940.
Data Protection in the Internet: French Report
169