CE - 437808

From GDPRhub
Revision as of 15:16, 16 March 2021 by Mh (talk | contribs) (Created page with "{{COURTdecisionBOX |Jurisdiction=France |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=CE |Court_With_Country=CE (France) |Case_Number_Name=437808 |ECLI=ECL...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
CE - 437808
Courts logo1.png
Court: CE (France)
Jurisdiction: France
Relevant Law: Article 83 GDPR
Decided: 01.03.2021
Published: 05.03.2021
Parties: Futura Internationale
National Case Number/Name: 437808
European Case Law Identifier: ECLI:FR:CECHR:2021:437808.20210301
Appeal from: CNIL
SAN-2019-010
Appeal to: Not appealed
Original Language(s): French
Original Source: Conseil d'Etat (in French)
Initial Contributor: n/a

The French Supreme Administrative Court (Conseil d'Etat) rejected Futura Internationale's appeal against the French DPA's decision to fine them €500,000. The Conseil d'Etat rejected the argument that the CNIL infringed the constitutional principle of non-retroactivity of the law by applying the GDPR and considered the fine proportionate.

English Summary

Facts

Futura Internationale appealed against the French DPA's decision to impose a fine of 500,000 EUR on Futura Internationale for sending unsolicited marketing communications.

Dispute

Did the French DPA breach the constitutional principle of non-retroactivity of the law by applying the GDPR?

Was the fine of €500,000 imposed by the French DPA proportionate?

Holding

The highest administrative court of France (Conseil d'Etat) dismissed the claim that even if the investigation by the (French DPA) CNIL started in March 2018, it continued after the date of entry into force of the GDPR. Futura Internationale was notified in October 2018. Therefore, the Court held that the French DPA (CNIL) applied the relevant law when applying the GDPR. There was not breach of the constitutional principle of non-retroactivity of the law by the CNIL.

The French Court then assessed Article 83 GDPR and reminded that Futura Internationale failed to comply with several GDPR obligations, including the principle of data minimisation, the obligation to inform data subjects, the obligation to respect the right to object, the obligation to cooperate with the DPA and the obligation to safeguard data transferred international. It held that the violation were particularly grave and persistent. Therefore, the Court concluded that the French DPA did not impose a disproportionate fine against Futura Internationale: 500,000 EUR fine was 2.5% of Futura Internationale's annual worldwide turnover.

Therefore, the French Court rejected Futura Internationale's appeal against the French DPA's decision.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.