Facebook Vs. The French Data Protection Agency: A Formal Notice To Have Facebook Comply With The French Data Protection Act

Author:Mr Michel Béjot (Bernard - Hertz - Béjot) and Caroline Bouvier (Bernard - Hertz - Béjot)
Profession:Global Advertising Lawyers Alliance (GALA)

On January 26, 2016, the French Data Protection Agency (Commission Nationale de l'Informatique et des Libertés, CNIL) issued a formal notice against Facebook Inc. and Facebook Ireland ("Facebook") because it held that Facebook does not fairly collect the browsing data of the web users (i.e., not Facebook's registered members) and does not allow its registered members to oppose the combination of their personal data for advertising purposes. The CNIL further elected to emphasize its decision by publishing this formal notice on its website in February 2016.

Further to Facebook's public announcement of the change to its Privacy Policy, a group, comprising members of five EU data protection agencies among the Article 29 Data Protection Working Party1 (France, Belgium, Netherlands, Spain and the Land of Hamburg), was put in place in March 2015.

It is in this context that the CNIL carried out on-site and online investigations in order to ensure that Facebook does comply with the French Data Protection Act.

These investigations led to the notice, by the CNIL, of several violations committed by Facebook.

Facebook's website (the "Website") is able to track/follow the browsing of the web users (who are not Facebook's registered members) on third parties websites, without informing them. Indeed, the Website stores cookies on the devices of the web users who visit a public Facebook page (e.g., a page of a public event), without securing their consent. These cookies then allow Facebook to identify all websites, containing a Facebook button "I like" or "Connect," that have been visited by the web-users; Facebook does not secure the express consent of the registering member when it collects, through the Website, data concerning the political or religious opinions, or the sexual preference of the registering member. In addition, the registration form of the Website does not contain any information of the rights of the registered member, nor of the contemplated use of the data collected through the Website; The Website stores advertising cookies on the registered members' devices without having first informed them, nor obtained their prior consent; In order to provide targeted ads to its registered members, the Website proceeds with a combination of all data of these registered members (data been voluntarily provided by the registered members, but also the data collected by the Website, or by other companies of the group, or data transmitted by...

To continue reading