CE - 448006

CE - 448006

Court:	CE (France)
Jurisdiction:	France
Relevant Law:	Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés
Decided:	30.09.2021
Published:
Parties:	CNP Assurances
National Case Number/Name:	448006
European Case Law Identifier:	ECLI:FR:CECHS:2021:448006.20210930
Appeal from:
Appeal to:	Unknown
Original Language(s):	French
Original Source:	Legifrance (in French)
Initial Contributor:	n/a

The French Council of State (CE) decided not to rule on the proportionality of the measures taken by the CNIL against a controller as the procedure had not yet come to an end. The CE cannot prejudge the final decision that the CNIL will take in terms of administrative sanctions.

English Summary

Facts

A data subject (the Complainant) filed a complaint with the French DPA (CNIL) against the decision of an insurance company (CNP Assurances) to interrupt the reimbursement of his loan following a health control, on the ground that such control would not be compliant with the GDPR. As a first measure, the CNIL requested CNP Assurances to provide explanations with respect to the health control. The Complainant considered that the CNIL did not take sufficient measures against the infringements.

Holding

The CE considered that the fact that the CNIL initially asked CNP Assurances to explain itself does not preclude the CNIL from adopting additional measures once a final decision is taken in the light of the response from CNP Assurances. In particular, the CE considered that asking the controller for explanations was merely a preparatory act in view of adopting an administrative decision. Therefore, the CE concluded that the CNIL had not committed any mistake by not yet issuing a formal notice or a sanction against CNP Assurances.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Considering the following procedure:

By a request, registered on December 19, 2020 at the litigation secretariat of the Council of State, Mrs. C ... A ... and Mr. B ... A ... ask the Council of State:

1 °) to note the irregularities of the acknowledgment of receipt from the CNIL of December 20, 2019;

2 °) to annul for excess of power the implicit decision of rejection resulting from the silence kept by the National Commission for Informatics and Freedoms on the complaint they presented to it on December 13, 2019.



Having regard to the other documents in the file;

Seen :
- Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016;
- Law n ° 78-17 of January 6, 1978;
- the code of public relations with the administration;
- the code of administrative justice;



After hearing in public session:

- the report by Mr Arno Klarsfeld, State Councilor,

- the conclusions of Mr. Laurent Domingo, public protractor;

The floor having been given, after the conclusions, to the SCP Nicolaÿ, of Lanouvelle, Hannotin, lawyer of the company CNP Assurances;




Considering the following:

1. It appears from the documents in the file that, by a complaint lodged on December 13, 2019, Mr. and Mrs. A ..., insured with the company CNP Assurances in the context of a real estate loan, asked the National Commission of data protection (CNIL) to ensure that this company complies with the provisions relating to health data of the regulation of April 27, 2016 known as the general data protection regulation (RGPD) and to obtain that it resume reimbursement , interrupted following a medical check, of the loan maturities for the part which falls to him. They ask the Council of State, on the one hand, to note the irregularities in the acknowledgment of receipt from the CNIL of December 20, 2019, on the other hand, to annul, for excess of power, the implicit decision of refusal. investigation of this complaint born of the silence kept by the CNIL following this letter.

2. In the first place, it does not come into the office of the administrative judge, seized of a substantive request, to "find the irregularity" of an administrative procedure. The conclusions presented for this purpose can therefore only be rejected.

3. Second, by letter of March 23, 2021, after the registration of the request, the CNIL asked CNP Assurances to send it its observations on the facts reported by Mr. and Mrs. A. .. and let her know the methods she uses and the measures she has taken. By letter of the same day, she informed Mr. and Mrs. A ... of this process. The CNIL having thus resumed the investigation of the complaint of Mr. and Mrs. A ..., their conclusions tending to the annulment of its decision not to act on it are, as the CNIL and the company CNP Assurances maintain, , no longer applicable on the date of this decision.

4. The applicants maintain, it is true, that the application retains an object in so far as it is directed against the refusal of the CNIL, on the one hand to send adequate, necessary and proportionate requests for information to the CNP. alleged breaches and, on the other hand, to use the powers of formal notice and sanction that it derives from the law of 6 January 1978 relating to information technology, files and freedoms to effectively put an end to the breaches that they denounce.

5. However, on the one hand, if Mr. and Mrs. A ... argue that the measures taken by the CNIL as part of the investigation of the file are insufficient in view of the extent and seriousness of the anomalies qu '' they note and with the consequences which result therefrom for them, the fact that the CNIL, at first, asked the company CNP Assurances to explain itself does not prejudge the measures which it will decide to take in view of the response obtained and, in any event, only constitutes a preparatory act for the administrative decision which will be taken subsequently. On the other hand, it does not appear from the documents in the file that the CNIL had, at the date of this decision, decided not to issue a formal notice or sanction against the CNP. It follows from the foregoing that there is no need to rule on the annulment conclusions presented by Mr. and Mrs. A ....




D E C I D E:
--------------
Article 1: There is no need to rule on the conclusions of the request of Mr. and Mrs. A ... as they relate to the refusal to follow up their complaint.
Article 2: The surplus of the conclusions of the request is rejected.

Article 3: This decision will be notified to Mr. B ... A ..., to the National Commission for Informatics and Freedoms and to the company CNP Assurances.

ECLI: FR: CECHS: 2021: 448006.20210930