Sunday, 22 April 2012

The French Data Protection Authority Questions Google On Its Privacy Policy

The French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés), was invited by the Article 29 Working Party (which brings together all the data protection authorities of the European Union) to take the lead in the analysis of Google's new privacy policy, that took effect on 1 March 2012.

On 16 March 2012, the CNIL sent Google a detailed questionnaire on its new confidentiality rules.

In its questionnaire, the CNIL asks Google 69 questions that are meant to clarify the implications the new confidentiality rules will have on the users of Google, whether these users have accounts, or are not authenticated or are simply passive users of Google services on other sites (publicity, measurement of audiences, etc).

Google's answers are supposed to help the European data protection authorities assess the compliance of Google’s services with European law.

The CNIL asked Google to reply to the questionnaire by 5 April 2012.

On 5 April 2012, Google answered the first 24 questions of the 69 questions asked, indicating to the press that it has negotiated a delay for the rest of its answer with the CNIL.

Read the questionnaire:

Facebook's Jurisdictional Clause is Null: the French Courts Have Jurisdiction

Court of Appeal of Pau, 23 March 2012,

A French user, who considered that Facebook had wrongly closed its Facebook account, brought a case against Facebook before the Civil Court of Bayonne for small cases ("Juridiction de Proximité"), claiming €1500 in damages.

Facebook Inc argued that its general terms and conditions provide that the courts of California entertain exclusive jurisdiction, and that the French courts therefore do not have jurisdiction.

In a judgement of 18 October 2011, the Civil Court of Bayonne ruled that indeed, following Facebook's argument, it did not have jurisdiction. The French Facebook user appealed against this judgement (at this stage only on the issue relating to the jurisdiction).

The Court of Appeal of Pau reversed the judgement and ruled that the French courts have jurisdiction, on the grounds of section 48 of the French Code of civil procedure which provides that:

“Any clause that departs, directly or indirectly, from the rules of territorial jurisdiction will be deemed non-existent unless it has been agreed between parties to a contract entered into as merchants and the same has been provided for in an explicit manner in the undertakings of the party against whom it will be enforced“.

A jurisdictional clause must therefore satisfy two cumulative conditions:

- the parties have to be merchants (and therefore not consumers),

- the clause must be presented in a very explicit manner, i.e. not written in small print and lost in a long contract.

In the present case, the Court of Appeal did not refer to the fact that the Facebook user was not a merchant, but insisted on the fact that the clause was written in English, in very small print, and that the user merely clicks to accept very long and involved terms and conditions.

Facebook has since translated its terms and conditions into French. Nevertheless, it is not certain that the jurisdictional clause is presented to the users in a sufficiently “explicit manner”.

Moreover, since the users of Facebook are mostly consumers, it does not seem that the jurisdictional clause, which gives exclusive jurisdiction to the Californian courts, will necessarily be valid. Nevertheless, not all Facebook users can be considered as consumers under French law, as many firms now use Facebook for corporate communications.

Read the case: