CE - 434684
| CE - 434684 | |
|---|---|
 | |
| Court: | CE (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 6(1)(a) GDPR Article 82 Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés |
| Decided: | 12.06.2020 |
| Published: | 19.06.2020 |
| Parties: | Association des agences de communication CNIL |
| National Case Number/Name: | 434684 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | French |
| Original Source: | CE (in French) |
| Initial Contributor: | JulesO3 |
French Conseil d’Etat settled that when forbidding the use of cookie walls in its recommendations, the CNIL exceeded what it could do within the framework of a soft law measure.
English Summary
Facts
L’association des agences de communication and others contested the legality of several recommendations and principles enshrined in the 4th of July 2019 CNIL deliberation on Article 82 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés.
Dispute
Could the CNIL decide a prohibition of “cookie walls” based on the EDPB 'soft law'?
Holding
The Conseil d’Etat considered that the CNIL outpaced its powers when considering cookie walls as illegal in a soft law measure (Article 2 of its 4th of July 2019 deliberation). Cookie walls are "the practice of blocking access to a website or mobile application for those who do not consent to be tracked ("cookie walls")" (CNIL deliberation, article 2).
The CNIL based its position on the EDPB (European Data Protection Board), stating that cookie walls should be forbidden because the cost of consent refusal is too high and thus the consent is not freely given (25 May 2018, on ePrivacy): "The EDPB considers that, in such a case, users are not in a position to refuse the use of tracers without suffering negative consequences (in this case, the ban from accessing the website)" (CNIL deliberation, article 2). CNIL concluded "that consent can only be valid if the person concerned is able to validly exercise his or her choice and does not suffer major inconvenience in the event of the absence or withdrawal of consent" (CNIL deliberation, article 2).
Nonetheless, the Court still considered the CNIL had overpassed its power: "By deducting such a general and absolute prohibition from the sole requirement of a free consent, laid down by the regulation of April 27, 2016, the CNIL has exceeded what it can legally do, within the framework of an instrument of soft law, enacted on the basis of 2° of I of article 8 of the law of January 6, 1978 cited in point 3. It follows that the contested deliberation is, to this extent, tainted with illegality" (CE).
All the remaining points of the CNIL guidelines were validated.
Comment
Several interpretations have resulted from this case. Some inferred that cookie walls was, therefore, a legal practice. In fact, the Conseil d’Etat recalled in its press release that the Court did not decide on the merits on that matter but only on the capacity of the CNIL to decide a general and absolute prohibition within the framework of a deliberation. A position that was also backed by the EDPB (19 novembre 2020 – “Letter of 13 July 2020 from News Media Europe and others”). EDPB position has been that consent should not be detrimental to the access to service. This position has been confirmed by the ECJ decision in Planet49.
Further Resources
Conseil d'Etat press release (French): "Le Conseil d’État annule partiellement les lignes directrices de la CNIL relatives aux cookies et autres traceurs de connexion"
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
