The French Council of State considers legal, the Commission Nationale de l’Informatique et des Libertés (CNIL), decision to engage in a consultation to define the new practical modalities of expression of consent in the matter of targeted advertising, and to grant a period of adaptation to the stakeholders.

Context

Pending the finalization of the new ePrivacy Regulation, there have recently been several material changes in the local regulations applying to cookies and tracking devices. The ePrivacy Directive requires consent types of cookies and tracking devices, and several national data protection authorities (including in France, Germany, the Netherlands and the UK) have started to change their guidance on cookies to take into account the changes brought by the General Data Protection Regulation (GDPR) on what constitutes valid consent.

In addition, the Court of Justice of the European Union (CJEU) announced, on 1 October 2019, its decision in the Planet49 case on the very issue of consent for cookies. An analysis of this decision may be found on our blog, Security & Privacy // Bytes.

Position of the CNIL

To account for this new legal framework, the CNIL published new guidelines in July 2019 explaining the new rules of consent for targeted advertising.

The CNIL has also decided to initiate a consultation with stakeholders to prepare a new official “recommendation” that will specify the “practical techniques for obtaining a valid consent". A draft of the recommendation would then be subject to six weeks of public consultation and the final recommendation published in the first quarter of 2020. Once final and published, the stakeholders will have a six-month adaptation period in which to implement the new rules.

Claims

Several associations have attacked this decision by the CNIL, as there is no valid reason to delay compliance with GDPR and protect privacy rights.

Decision by the Council of State

In its decision of 16 October 2019, the Council of State dismissed the claim by the associations.

The Council of State noted that the CNIL, as an independent authority, has the power to create this type of action plan, with a view to achieving effective compliance with data protection regulation. It considered that, within the framework of this plan, it is not illegal to grant time to stakeholders for compliance with the new rules once they are published. This tolerance period is intended to allow stakeholders to fully assimilate the new rules, once the CNIL has set them out in relevant detail, and thus to fully comply with GDPR requirements by the summer of 2020.

The Council of State decided the action plan does not neglect privacy rights, as it is precisely intended to fight more efficiently against illegal advertising practices. Moreover, it will not prevent the CNIL from controlling compliance with the other obligations during this transition period and from sanctioning, where appropriate, the most serious breaches of this new legal framework.