requirements for authorizing the profiling, it grants the data subject the right not to be
subject to a decision based solely on automated processing, including profiling.
57
In France, the constitutionality of legislation enacted to adapt domestic law to the
GDPR has been challenged in respect of this particular topic. The Conseil
Constitutionnel held that a decision based on automated processing is possible, as
long as it obeys to certain conditions, such as the fact that it does not involve the
processing of sensitive data and it is subject to an administrative appeal.
58
Some other aspects of data protection though electronic means are separately
dealt with in the following pages in a more detailed way. First, national legal systems
will be compared in respect of the existence of legislation or relevant case law
covering the protection of personal data in the context of services provided at a
distance, by electronic means, at the individual request of a recipient of services.
Subsequently, specific aspects of data protection in this context will be compared in
the jurisdictions covered by this report, such as electronic communications for
marketing purposes, protection of minors, the existence of a right to be forgotten,
the processing of employees’ data and security obligations and data breach
notifications.
3.1.1 Processing of Personal Data in the Context of Services Provided at
a Distance by Electronic Means
Even before the adoption of the GDPR, the European Union had set out a considerable number of rules, both through the Directive on electronic commerce
59 and
through the Directive on privacy and electronic communications,
60 which are
applicable to services provided at a distance, by electronic means, at the individual
request of their recipient. These rules reinforce the protection of data subjects
whenever their personal data are processed in the context of electronic
communications.
The European Union’s Directive on electronic commerce, expressing consumer
protection concerns, addresses the requirements for the conclusion of contracts by
electronic means by imposing that certain information be mandatorily provided in a
durable medium, such that the recipient of the services may store and reproduce
it. When combined with the obligation to provide certain minimum information to
data subjects relating to personal data processing, set forth in the GDPR,
61 this
57 See article 22 of the GDPR.
58 See the French National Report, Sect. 2.
59 See Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on
certain legal aspects of information society services, in particular electronic commerce, in the
Internal Market (“Directive on electronic commerce”), OJ L 178, 17.07.2000, pp. 1 ff.
60 See Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002
concerning the processing of personal data and the protection of privacy in the electronic communications sector (“Directive on privacy and electronic communications”), OJ L 201, 31.7.2002,
pp. 37 ff.
61 See article 13 of the GDPR.
Data Protection in the Internet: General Report
13
subject to a decision based solely on automated processing, including profiling.
57
In France, the constitutionality of legislation enacted to adapt domestic law to the
GDPR has been challenged in respect of this particular topic. The Conseil
Constitutionnel held that a decision based on automated processing is possible, as
long as it obeys to certain conditions, such as the fact that it does not involve the
processing of sensitive data and it is subject to an administrative appeal.
58
Some other aspects of data protection though electronic means are separately
dealt with in the following pages in a more detailed way. First, national legal systems
will be compared in respect of the existence of legislation or relevant case law
covering the protection of personal data in the context of services provided at a
distance, by electronic means, at the individual request of a recipient of services.
Subsequently, specific aspects of data protection in this context will be compared in
the jurisdictions covered by this report, such as electronic communications for
marketing purposes, protection of minors, the existence of a right to be forgotten,
the processing of employees’ data and security obligations and data breach
notifications.
3.1.1 Processing of Personal Data in the Context of Services Provided at
a Distance by Electronic Means
Even before the adoption of the GDPR, the European Union had set out a considerable number of rules, both through the Directive on electronic commerce
59 and
through the Directive on privacy and electronic communications,
60 which are
applicable to services provided at a distance, by electronic means, at the individual
request of their recipient. These rules reinforce the protection of data subjects
whenever their personal data are processed in the context of electronic
communications.
The European Union’s Directive on electronic commerce, expressing consumer
protection concerns, addresses the requirements for the conclusion of contracts by
electronic means by imposing that certain information be mandatorily provided in a
durable medium, such that the recipient of the services may store and reproduce
it. When combined with the obligation to provide certain minimum information to
data subjects relating to personal data processing, set forth in the GDPR,
61 this
57 See article 22 of the GDPR.
58 See the French National Report, Sect. 2.
59 See Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on
certain legal aspects of information society services, in particular electronic commerce, in the
Internal Market (“Directive on electronic commerce”), OJ L 178, 17.07.2000, pp. 1 ff.
60 See Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002
concerning the processing of personal data and the protection of privacy in the electronic communications sector (“Directive on privacy and electronic communications”), OJ L 201, 31.7.2002,
pp. 37 ff.
61 See article 13 of the GDPR.
Data Protection in the Internet: General Report
13