CE - 448006

CE - 448006
Court:	CE (France)
Jurisdiction:	France
Relevant Law:	Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés
Decided:	30.09.2021
Published:
Parties:
National Case Number/Name:	448006
European Case Law Identifier:	ECLI:FR:CECHS:2021:448006.20210930
Appeal from:
Appeal to:	Unknown
Original Language(s):	French
Original Source:	Legifrance (in French)
Initial Contributor:	n/a

The judge does not rule on the proportionality of the measures taken by the CNIL as the procedure has not been completed. He cannot prejudge what the CNIL will decide in terms of an administrative sanctions later on.

English Summary

Facts

Complainant has contested the decision of CNP Assurances to interrupt the reimbursement of his loan following a health control as it might be incompatible with GDPR. Complainant considered that the CNIL has not taken sufficient measures as infirgements were stated.

Holding

The considered that the fact that the CNIL initially asked CNP Assurances to explain itself does not prejudge the measures it will decide to take in the light of the reply received and, in any event, is merely a preparatory act for the administrative decision that will be taken later. Therefore, it does not appear from the documents in the file that the CNIL has, as of the date of this decision, decided not to issue a formal notice or a sanction against the CNP.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Considering the following procedure:

By a request, registered on December 19, 2020 at the litigation secretariat of the Council of State, Mrs. C ... A ... and Mr. B ... A ... ask the Council of State:

1 °) to note the irregularities of the acknowledgment of receipt from the CNIL of December 20, 2019;

2 °) to annul for excess of power the implicit decision of rejection resulting from the silence kept by the National Commission for Informatics and Freedoms on the complaint they presented to it on December 13, 2019.



Having regard to the other documents in the file;

Seen :
- Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016;
- Law n ° 78-17 of January 6, 1978;
- the code of public relations with the administration;
- the code of administrative justice;



After hearing in public session:

- the report by Mr Arno Klarsfeld, State Councilor,

- the conclusions of Mr. Laurent Domingo, public protractor;

The floor having been given, after the conclusions, to the SCP Nicolaÿ, of Lanouvelle, Hannotin, lawyer of the company CNP Assurances;




Considering the following:

1. It appears from the documents in the file that, by a complaint lodged on December 13, 2019, Mr. and Mrs. A ..., insured with the company CNP Assurances in the context of a real estate loan, asked the National Commission of data protection (CNIL) to ensure that this company complies with the provisions relating to health data of the regulation of April 27, 2016 known as the general data protection regulation (RGPD) and to obtain that it resume reimbursement , interrupted following a medical check, of the loan maturities for the part which falls to him. They ask the Council of State, on the one hand, to note the irregularities in the acknowledgment of receipt from the CNIL of December 20, 2019, on the other hand, to annul, for excess of power, the implicit decision of refusal. investigation of this complaint born of the silence kept by the CNIL following this letter.

2. In the first place, it does not come into the office of the administrative judge, seized of a substantive request, to "find the irregularity" of an administrative procedure. The conclusions presented for this purpose can therefore only be rejected.

3. Second, by letter of March 23, 2021, after the registration of the request, the CNIL asked CNP Assurances to send it its observations on the facts reported by Mr. and Mrs. A. .. and let her know the methods she uses and the measures she has taken. By letter of the same day, she informed Mr. and Mrs. A ... of this process. The CNIL having thus resumed the investigation of the complaint of Mr. and Mrs. A ..., their conclusions tending to the annulment of its decision not to act on it are, as the CNIL and the company CNP Assurances maintain, , no longer applicable on the date of this decision.

4. The applicants maintain, it is true, that the application retains an object in so far as it is directed against the refusal of the CNIL, on the one hand to send adequate, necessary and proportionate requests for information to the CNP. alleged breaches and, on the other hand, to use the powers of formal notice and sanction that it derives from the law of 6 January 1978 relating to information technology, files and freedoms to effectively put an end to the breaches that they denounce.

5. However, on the one hand, if Mr. and Mrs. A ... argue that the measures taken by the CNIL as part of the investigation of the file are insufficient in view of the extent and seriousness of the anomalies qu '' they note and with the consequences which result therefrom for them, the fact that the CNIL, at first, asked the company CNP Assurances to explain itself does not prejudge the measures which it will decide to take in view of the response obtained and, in any event, only constitutes a preparatory act for the administrative decision which will be taken subsequently. On the other hand, it does not appear from the documents in the file that the CNIL had, at the date of this decision, decided not to issue a formal notice or sanction against the CNP. It follows from the foregoing that there is no need to rule on the annulment conclusions presented by Mr. and Mrs. A ....




D E C I D E:
--------------
Article 1: There is no need to rule on the conclusions of the request of Mr. and Mrs. A ... as they relate to the refusal to follow up their complaint.
Article 2: The surplus of the conclusions of the request is rejected.

Article 3: This decision will be notified to Mr. B ... A ..., to the National Commission for Informatics and Freedoms and to the company CNP Assurances.

ECLI: FR: CECHS: 2021: 448006.20210930