News October 2019: awaiting for (final) Cooking recipe…..

Quick reminder:

The information banner stating that scrolling down or swiping through a website constitutes web user’s appropriate consent to place Cookies on his local machine and the pre-ticked checkbox giving one’s consent by default are no longer valid.

From now on, it is clear that the consent for the implementation of Cookies on the web user’s local machine may not be tacit or implicit anymore: pursuant to the terms of article 4 of Regulation n°2016/679 of 27 April 2016 (GDPR), consent means “any freely given, specific, informer and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”

Warning: Overview of recent updates in this matter:

• Action plan of the CNIL^[1] dated June 28, 2019: The CNIL considered, on June 28, 2019, that the enforcement of GDPR made obsolete its previous Deliberation n°2013-378 dated December 5, 2013 on Cookies and other tracers. In this document, the CNIL considered that web browsing could be regarded as a valid expression of the consent to the implementation of Cookies on the web user’s local machine
• CNIL’s Deliberation n°2019-093 dated July 4, 2019: pursuant to article 2 of this deliberation, the CNIL considers that the consent to the implementation of Cookies “shall be expressed by means of a positive action of the data subject which shall be previously informed of the consequences of his choice and be in capacity to effectively make such choice. Scrolling down or swiping through a website or an application can no longer be viewed as a valid expression of consent to the implementation of Cookies”.  Under this Deliberation, the CNIL considers that, as an interim measure, a period of adaptation ending six months after the publication of the future recommendation (scheduled during the first calendar of 2020) will be given to stakeholders in order to allow them to implement the new rules.
• Decision of the Conseil d’Etat[2] dated August 14, 2019: the CNIL’s Deliberation dated 4 July 2019 (and in particular the period of adaptation granted to stakeholders) has been challenged before the Conseil d’Etat by means of an interim relief proceedings. However such proceedings has been rejected as it appeared redundant with a pending procedure aiming at the cancellation of same Deliberation scheduled before the Conseil d’Etat on September 30.
• CJEU 1^st October 2019 Planet49, aff. C-673/17: pursuant to GDPR and article 5§3 of Directive 2002/58/EC dated 12 July 2002 on privacy and electronic communications as amended by Directive 2009/136/EC of 25 November 2009, the CJEU considers that consent, granted by means of a pre-ticked checkbox by default, to the storing and access of information on the web user’s local machine is not valid, such information being personal data or not.

“In that regard, it would appear impossible in practice to ascertain objectively whether a website user had actually given his or her consent to the processing of his or her personal data by not deselecting a pre-ticked checkbox nor, in any event, whether that consent had been informed. It is not inconceivable that a user would not have read the information accompanying the preselected checkbox, or even would not have noticed that checkbox, before continuing with his or her activity on the website visited” (§ 55 of the precited decision)

• Decision of the Conseil d’Etat dated October 16, 2019: in this decision, the Conseil d’Etat approves of the period of adaptation decided by the CNIL in its deliberation n°2019-093 and considers that the CNIL’s tolerance aims at a legitimate goal which is to allow the concerned stakeholders to assimilate new rules and therefore to fully comply with GDPR requirements by Summer 2020.

 

News/updates:  

Following the rejection of the proceedings initiated by the Conseil d’Etat, the period of adaptation granted by the CNIL in its Deliberation n°2019-093 de la CNIL is therefore approved: editors of websites and stakeholders have until mid-2020 to change their tracking devices and terms for consent for the implementation of Cookies on user’s local machine, which shall comply with GDPR requirements under article 4.

The CNIL’s recommendation, scheduled for the first calendar of 2020, should provide, in this regard, interesting information re. practical means for collecting valid consent, as expected by the CNIL.

Until mid-2020, Deliberation n°2013-378 allowing the “tacit” consent by swiping through a website still applies. However, it may not be excluded that, in light of the CJEU’s last decision dated 1^st October 2019 (which clearly rejects all implicit ways to collect consent), the CNIL advances the adoption of its new recommendation which would, consequently and in a sliding manner, have an impact on the date by which the stakeholders will have to comply with these new rules.

Undoubtedly, the sooner the operators will anticipate changes on their “Cookies policy” the better…

                                                                                                                                                                by Sarah Temple-Boyer, Attorney

                                                                                                                                                                                    

---

[1] French Data Protection Authority

[2] French Supreme Court for administrative matters