Court case N° 503163 – Court Ruling (France, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An association, les Licornes Ceélestes, brought an action before the Conseil d’Etat (Supreme Administrative Court) seeking, on a interim basis, the suspension of the execution of an order of the CNIL authorising the European Medicines Agency (EMA) to implement automated processing of the personal data of the general population in France for a study on the incidence and prevalence of pathologies within the framework of the “DARWIN EU” project. In the alternative, they sought a referral of questions to the CJEU concerning the validity, in light of the Charter, of Commission Implementing decision (EU) No 2023/1995 (authorising the EU-US Data Privacy Framework. The organisation claimed that the requisite urgency condition for such interim relief is satisfied as the propose processing concerns the health data of 10 million French people which would be hosted by Microsoft. This would necessitate transfers to the US where, they allege, there are insufficient guarantees as to the protection of personal data. The organisation further argued that there exists doubt as to the legality of the Commission’s decision to authorise the transfer, that it contains serious errors of law, fact and assessment by stating that no transfer to the US will take place when Microsoft cannot technically guarantee that the processing will occur solely in the EU. The organisation noted that the authorisation which permitted “technical usage data” to be transferred to the US incorrectly regarded this type of data as not constituting personal data. The Court noted that the standard required for the awarding of interim relief in this scenario is that the contested administrative decision causes a sufficiently serious and immediate harm to a public interest and whether it is sufficiently serious to warrant intervention pending a full hearing on the matter. Although acknowledging the risk of a request for access to the data by the US, the Court characterized this risk as “hypothetical” in light of t
An association, les Licornes Ceélestes, brought an action before the Conseil d’Etat (Supreme Administrative Court) seeking, on a interim basis, the suspension of the execution of an order of the CNIL authorising the European Medicines Agency (EMA) to implement automated processing of the personal data of the general population in France for a study on the incidence and prevalence of pathologies within the framework of the “DARWIN EU” project. In the alternative, they sought a referral of questions to the CJEU concerning the validity, in light of the Charter, of Commission Implementing decision (EU) No 2023/1995 (authorising the EU-US Data Privacy Framework. The organisation claimed that the requisite urgency condition for such interim relief is satisfied as the propose processing concerns the health data of 10 million French people which would be hosted by Microsoft. This would necessitate transfers to the US where, they allege, there are insufficient guarantees as to the protection of personal data. The organisation further argued that there exists doubt as to the legality of the Commission’s decision to authorise the transfer, that it contains serious errors of law, fact and assessment by stating that no transfer to the US will take place when Microsoft cannot technically guarantee that the processing will occur solely in the EU. The organisation noted that the authorisation which permitted “technical usage data” to be transferred to the US incorrectly regarded this type of data as not constituting personal data. The Court noted that the standard required for the awarding of interim relief in this scenario is that the contested administrative decision causes a sufficiently serious and immediate harm to a public interest and whether it is sufficiently serious to warrant intervention pending a full hearing on the matter. Although acknowledging the risk of a request for access to the data by the US, the Court characterized this risk as “hypothetical” in light of t
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case N° 503163 in FR
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case N° 503163 - France (2025). Retrieved from cookiefines.eu
Last updated: