Sunday, 5 May 2013

Personal data: no notification needed for a simple software update

French Supreme Court (Cour de cassation, chambre sociale), 23 April 2013, 11-26.099 (published in the bulletin)

Under article 22 of the French personal data Act, automatic processing of personal data must be notified to the French personal data authority CNIL.

In the present case, a youth educator had been dismissed for refusing to enter data concerning minors under protective measures into a software that had been updated. The employee considered that he was not obliged to accept allegedly unlawful orders given by the employer.

The Court of Appeal of Aix-en-Provence found that the dismissal of the employee was not justified, because when the computer program EVA 3 was upgraded in January 2007 to EVA 4, personal data, which had been originally notified to the CNIL, had to be re-entered into the system by the educators, which meant that they had to be notified a second time to the CNIL beforehand.

The French Supreme Court has annulled the judgement of the Court of Appeal, stating that "only a substantial change in the information that has been previously declared has to be notified to the CNIL". The Court added that the mere updating of a computer program processing personal data does not entail an obligation for the data controller to notify the data-processing a second time.

The Supreme Court therefore annulled the judgement of the Court of Appeal of Aix-en-Provence as it had not verified whether the change of the computer program was a simple update or a change necessitating a new notification to the CNIL.

Read the case: Judgement

Feel free to contact me:
Visit our website: YS Avocats