French Supreme Court (Cour de cassation, chambre sociale), 23 April 2013, 11-26.099 (published in the bulletin)
Under article 22 of the French
personal data Act, automatic processing of personal data must be notified to
the French personal data authority CNIL.
In the present case, a youth
educator had been dismissed for refusing to enter data concerning minors under
protective measures into a software that had been updated. The employee
considered that he was not obliged to accept allegedly unlawful orders given by
the employer.
The Court of Appeal of
Aix-en-Provence found that the dismissal of the employee was not justified,
because when the computer program EVA 3 was upgraded in January 2007 to EVA 4,
personal data, which had been originally notified to the CNIL, had to be
re-entered into the system by the educators, which meant that they had to be
notified a second time to the CNIL beforehand.
The French Supreme Court has
annulled the judgement of the Court of Appeal, stating that "only a
substantial change in the information that has been previously declared has to
be notified to the CNIL". The Court added that the mere updating of a
computer program processing personal data does not entail an obligation for the
data controller to notify the data-processing a second time.
The Supreme Court therefore
annulled the judgement of the Court of Appeal of Aix-en-Provence as it had not verified
whether the change of the computer program was a simple update or a change
necessitating a new notification to the CNIL.
Read the case: Judgement
