Court case 473254 – Court Ruling (France, 2024)

A data subject lodged a complaint to the French DPA (“CNIL”) regarding workplace video surveillance on the controller’s premises. The CNIL led an investigation on 21 June 2022. During said investigation, the person in charge of the premises did not object to the investigation, however the manager then instructed the person in charge of the premises not to sign the inspection report, and did not respond to phone calls and messages sent to him by the agents of the CNIL. The controller did not reply to requests for information and documents, nor to reminders sent by the DPA. On 2 December 2022, the CNIL sent a report proposing to impose an administrative fine and an injunction to provide the information requested, to which no response was received. In a letter dated 22 December 2022, the controller’s lawyer submitted observations and communicated only part of the information and documents requested. The CNIL imposed a €10,000 fine on 8 February 2023 for not cooperating with the DPA. The CNIL also asked that the controller provide the documents requested and provide detailed answers to the questions asked, subject to a penalty of €50 per day of delay at the end of the period of one month following the notification of this decision. The controller asked the French Supreme Administrative Court (“Conseil d’Etat”) to annul this decision. Firstly, pursuant to Article 58(1)(a) GDPR, a supervisory authority may order the controller to provide it with any information and personal data it requires to do its duties. Furthermore, Article 31 GDPR states that the controller must cooperate with the supervisory authority. The Conseil d’Etat considered that the controller did not provide the CNIL with the documents and information requested on the video surveillance systems installed on its business premises, thereby depriving the CNIL of the means necessary to verify the controller’s compliance with the GDPR. Secondly, the Conseil d’Etat also considered that the documents the controller produced were insufficient to enable compliance of their video surveillance system with the GDPR. Therefore, the plea alleging insufficient reasons were given for the penalty was rejected by the Conseil d’Etat. Lastly, the Conseil d’Etat noted that to impose a €10,000 fine, the CNIL took into consideration the controller’s failure to cooperate, its deliberate nature and the fact that they prevented the CNIL from verifying that the video surveillance system installed complied with the GDPR. Therefore, the Conseil d’Etat indicated that the CNIL did not impose a disproportionate fine on the company. The application for annulment was thus dismissed by the Conseil d’Etat.