Conseil d'Etat, 6 novembre 2009, n° 304300 et 304301
Avec le développement de l’informatique et des réseaux, toutes les entreprises sont amenées à mettre en œuvre des traitements de données personnelles (gestion de clients, prospection commerciale, gestion des salariés, etc.).
Ces traitements de données personnelles doivent respecter les règles imposées par la loi informatique et liberté de 1978 (modifiée par la loi du 6 août 2004), et la CNIL a le pouvoir d’effectuer des contrôles sur place auprès des responsables des traitements.
La décision de procéder à une mission de contrôle appartient au Président de la CNIL, qui n’est pas obligé de prévenir le responsable du traitement, et ce afin de ménager l’effet de surprise indispensable à la réussite du contrôle (les traitements illicites étant faciles à supprimer).
Or, le Conseil d’Etat vient d’annuler (par deux décisions en date du 6 novembre 2009, n° 304300 et 304301) deux sanctions prises par la CNIL à l’encontre de sociétés de prospection téléphonique qui utilisaient des données personnelles en violation des dispositions de la loi informatique et libertés.
Au visa de l’article 8 de la Convention européenne des droits de l’homme et du principe de proportionnalité de l’ingérence d’une autorité publique dans la marche normale des affaires, le Conseil d’Etat a estimé que le responsable de locaux doit être prévenu de la visite de contrôle. Selon le Conseil, le responsable des locaux doit être mis en mesure de pouvoir exercer son pouvoir de s’opposer à la visite de la CNIL (ce droit est prévu par la loi), la visite s’exerçant alors avec une autorisation judiciaire.
Suite aux décisions du Conseil d’Etat, la CNIL doit donc aujourd’hui soit prévenir le responsable des locaux de la visite de contrôle prévue (ce qui rend le contrôle inefficace), soit, et c’est certainement ce que la CNIL fera, requérir préalablement à toute visite l’autorisation du juge judiciaire. La loi sera sans doute modifiée en ce sens.
IPIT NEWS FROM FRANCE, by YS Avocats law firm, www.ys-avocats.com
Monday, 12 April 2010
Whistle-blowing: The Sarbanes-Oxley Act in France
The CNIL (the French data controller – La Commission Nationale de l’Informatique et des Libertés) defines a ‘whistle-blowing device’ as a system put at the disposal of the employees of a public or a private body in addition to the normal ways of alerting the malfunctioning of the body, in order to incite them to signal to their employer any behaviour that they consider violates the applicable rules. The CNIL admitted the use of whistle-blowing in order to enable French companies to comply with the Sarbanes-Oxley Act of 30 July 2002, which imposes the implementation of whistle-blowing systems, as well as with the French law relating to personal data processing (“Informatique et Libertés” Act). French firms and subsidiaries of companies quoted on the New York Stock Exchange indeed have to comply with the Sarbanes-Oxley Act, in particular by implementing whistle-blowing systems.
In order to simplify procedures, the CNIL adopted a ‘Single Authorisation’ which sets the conditions with which companies must comply in order to benefit from a simplification of the procedures that have to be accomplished to implement whistle-blowing systems (Single authorisation: http://www.cnil.fr/en-savoir-plus/deliberations/deliberation/delib/83/). When a company wishes to implement such systems, it only has to declare that its system complies with the conditions set out by the ‘single authorisation’.
The whistle-blowing systems are in compliance with the single authorisation if certain conditions are met, in particular the following:
- alerts may only be concerned with accounting, banking and the fight against corruption;
- companies that want to implement such devices must warn employees by making certain information available to them;
- the system must not encourage anonymous denunciations.
The French Supreme Court (Cour de cassation), in a ruling of 8 December 2009 (concerning the Code of Behaviour of Dassault Systèmes relating to information for internal use and whistle-blowing), decided that a whistle-blowing system may be used only for the purpose of internal control in the fields of finance, accounting, banking and the fight against corruption. The device implemented by the group Dassault Systèmes had a wider objective, insofar as the system also concerned the breach of conduct rules distinct from such purposes; therefore the whistle-blowing system could not benefit from the CNIL’s ‘single authorisation’.
The Supreme Court's interpretation of the scope of the ‘single authorisation’ is thus extremely restricted. Indeed, the CNIL’s single authorisation provides that the single authorisation may also concern alerts relating to facts that undermine “the vital interests of the organisation or the physical or moral integrity of the employees” (section 3 of the single authorisation).
The CNIL indicated that it would soon modify its ‘single authorisation’ in order to take this ruling into consideration.
BRAD SPITZ
www.bradspitz.com
In order to simplify procedures, the CNIL adopted a ‘Single Authorisation’ which sets the conditions with which companies must comply in order to benefit from a simplification of the procedures that have to be accomplished to implement whistle-blowing systems (Single authorisation: http://www.cnil.fr/en-savoir-plus/deliberations/deliberation/delib/83/). When a company wishes to implement such systems, it only has to declare that its system complies with the conditions set out by the ‘single authorisation’.
The whistle-blowing systems are in compliance with the single authorisation if certain conditions are met, in particular the following:
- alerts may only be concerned with accounting, banking and the fight against corruption;
- companies that want to implement such devices must warn employees by making certain information available to them;
- the system must not encourage anonymous denunciations.
The French Supreme Court (Cour de cassation), in a ruling of 8 December 2009 (concerning the Code of Behaviour of Dassault Systèmes relating to information for internal use and whistle-blowing), decided that a whistle-blowing system may be used only for the purpose of internal control in the fields of finance, accounting, banking and the fight against corruption. The device implemented by the group Dassault Systèmes had a wider objective, insofar as the system also concerned the breach of conduct rules distinct from such purposes; therefore the whistle-blowing system could not benefit from the CNIL’s ‘single authorisation’.
The Supreme Court's interpretation of the scope of the ‘single authorisation’ is thus extremely restricted. Indeed, the CNIL’s single authorisation provides that the single authorisation may also concern alerts relating to facts that undermine “the vital interests of the organisation or the physical or moral integrity of the employees” (section 3 of the single authorisation).
The CNIL indicated that it would soon modify its ‘single authorisation’ in order to take this ruling into consideration.
BRAD SPITZ
www.bradspitz.com
Subscribe to:
Posts (Atom)