CNIL sanction procedure overruled by the Court of Appeal

In late 2006, the French data protection authority issued a 30,000 euro sanction against Inter Confort for improper handling of objection requests to direct marketing via telephone. The sanction followed the CNIL’s onsite investigation of Inter Confort. Inter Confort challenged this sanction decision before the Court of Appeal (Conseil d’Etat) on procedural grounds. The onsite investigation procedural rules set forth by the Data Protection Act and its implementation decree provide extensive powers to the authority to access private premises, even outside of business hours, without prior warning and without the data controller being present. These powers being almost limitless, the court considered that it was essential “for proportionality purposes” to counterbalance them by putting them under the control of a judge of the judiciary system. The court considers this to be achieved by the DP Act insofar as it gives the right to the data controller to object to the investigation, in which case the investigation can occur only with the prior authorization of a judge. As defendants must be made aware of their rights, the Appeal Court cancelled the CNIL decision because the authority failed to inform the data controller of its right to object to the investigation.