VOODOO – Court Ruling (France, 2024)

The controller appealed [https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2022-026 decision SAN-2022-026] of the French DPA ('CNIL') before the French Supreme Administrative Court ('Conseil d'Etat). The CNIL fined the controller €3,000,000 for failing to obtain data subjects' consent for advertising purposes, regarding "Identifiers for Vendors" when using the controller's apps on Apple devices. The DPA also ordered an injunction requiring the controller to bring its data processing into compliance within a period of three months from notification of the deliberation. This was subject to a fine of €20,000 per day of delay. The controller sought to reduce the fine amount. The Conseil d'Etat rejected the controller's request and upheld the DPA's €3,000,000 fine. First, Article 82 of the French Data Protection Act requires that any operation of collection or deposit of information stored in the terminal of a data subject must be subject to prior, clear and complete information relating to the purpose of cookies or other tracers and the means available to data subjects to oppose them, as well as the prior collection of their consent. Two exceptions exist to this requirement: (i) if the activity has the exclusive purpose of allowing or facilitating communication by electronic means and (ii) if it is strictly necessary to the provision of an online communication service at the express request of the user. The Conseil d'Etat considered that the DPA had sufficiently established the facts regarding the breach of [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the French Data Protection Act] (loi 78-17 du 6 janvier 1978, Informatique et Libertés), as the controller did not obtain the necessary consent to collect data subjects' data and its activities did not fall into one of the exceptions to this requirement. Second, the Conseil d'Etat also held that the DPA followed the correct procedures when deciding the fine to be imposed on the controller. In making the decision, the DPA correctly took into account several factors including for example the number of data subjects and the seriousness of the breach (Article 83(2)(a) GDPR), the financial situation of the controller in its economic sector and the fact the controller derived more than 95% of its income from advertising, and thereby gained financial advantage from the breach (Article 83(2)(k) GDPR). Finally, the Council d'Etat further noted that neither the GDPR nor the French Data Protection Act require the DPA to explain the reasoning behind the amount of sanctions imposed, and therefore the DPA had not disregarded the principle of legality and proportionality of penalties when deciding the penalty amount.