In the event of misuse of personal data for marketing purposes, the CNIL
complaints department may be seized as may the public prosecutor’s office. The
victim may also take the matter to a national platform for combatting spam.
171
Employees may object to the installation of devices that fail to comply with the
statutory conditions set out in the legal texts or by the CNIL. Should rules on data
protection be disregarded, employees may take the matter to the CNIL, the work
inspectorate or the public prosecutor’s office.
In the event of fraudulent access to a system, other rules of the Criminal Code
apply.
172 There are also a number of offences under general law (e.g. data theft is
punishable by a €75,000 fine and five years’ imprisonment). Forgery may be
punished in both criminal and civil law.
7 Private International Law Rules
The CNIL has jurisdiction whenever the controller is based on French soil, or if not
based in France whenever the controller implements means of processing located in
France.
The Act of 3 June 2016 strengthening the fight against organized crime, terrorism
and their financing and improving the effectiveness and safeguards of criminal
procedure introduced a new article 113-2-1 to the Criminal Code, which reads:
Any serious offence committed using an electronic communications network, where it is
attempted or is effected to the prejudice of a natural person residing in the territory of the
Republic or a legal entity whose head office is in the territory of the Republic, is deemed to
be committed in the territory of the Republic.
Whenever a company based outside the European Union uses means of
processing located on French soil, then French law applies, as in a recent example
involving WhatsApp.
173
Where data transfer is concerned, European rules were introduced by the Act of
6 August 2004 and others by the Act of 20 June 2018.
Data may only be transferred to a state not belonging to the European Union if the
level of protection of the recipient state is adequate.
174 However, an exception is
provided whenever the data subject has expressly consented to the transfer of their
data or because of the nature of the data.
175 The CNIL may also decide to authorise
the transfer.
171 Association “Signal Spam”: www.signal-spam.fr or Service 33700 (www.33700-spam-sms.fr).
172 CP, Articles 323-1 ff.
173 CNIL, Dec. no MED-2017-075 of 27 November 2017.
174 LIL, Article 123.
175 LIL, Article 124.
Data Protection in the Internet: French Report
179
complaints department may be seized as may the public prosecutor’s office. The
victim may also take the matter to a national platform for combatting spam.
171
Employees may object to the installation of devices that fail to comply with the
statutory conditions set out in the legal texts or by the CNIL. Should rules on data
protection be disregarded, employees may take the matter to the CNIL, the work
inspectorate or the public prosecutor’s office.
In the event of fraudulent access to a system, other rules of the Criminal Code
apply.
172 There are also a number of offences under general law (e.g. data theft is
punishable by a €75,000 fine and five years’ imprisonment). Forgery may be
punished in both criminal and civil law.
7 Private International Law Rules
The CNIL has jurisdiction whenever the controller is based on French soil, or if not
based in France whenever the controller implements means of processing located in
France.
The Act of 3 June 2016 strengthening the fight against organized crime, terrorism
and their financing and improving the effectiveness and safeguards of criminal
procedure introduced a new article 113-2-1 to the Criminal Code, which reads:
Any serious offence committed using an electronic communications network, where it is
attempted or is effected to the prejudice of a natural person residing in the territory of the
Republic or a legal entity whose head office is in the territory of the Republic, is deemed to
be committed in the territory of the Republic.
Whenever a company based outside the European Union uses means of
processing located on French soil, then French law applies, as in a recent example
involving WhatsApp.
173
Where data transfer is concerned, European rules were introduced by the Act of
6 August 2004 and others by the Act of 20 June 2018.
Data may only be transferred to a state not belonging to the European Union if the
level of protection of the recipient state is adequate.
174 However, an exception is
provided whenever the data subject has expressly consented to the transfer of their
data or because of the nature of the data.
175 The CNIL may also decide to authorise
the transfer.
171 Association “Signal Spam”: www.signal-spam.fr or Service 33700 (www.33700-spam-sms.fr).
172 CP, Articles 323-1 ff.
173 CNIL, Dec. no MED-2017-075 of 27 November 2017.
174 LIL, Article 123.
175 LIL, Article 124.
Data Protection in the Internet: French Report
179