FRANCE—Fashion industry: CNIL authorization to process conviction data to fight against IP rights infringement

 

The needs of the fashion industry have been taken into account by the CNIL in two noticeable decisions of April 28, 2011, by which the CNIL authorised Chanel SA to process data relating to offences and convictions for the management of the company’s intellectual property rights—trademarks, copyright, patents, design and models—and the management and the follow-up of pre-disputes and litigations.

These activities require the processing of data about violations of IP rights and decisions of courts and trademark/patent offices. The company needed CNIL’s prior authorisation due to the sensitivity of the information processed, as required by article 25-I-3° of French Data Protection Law, which applies to data processing based on offences, convictions or security measures.

These decisions are interesting at two levels. First, very few companies have so far dared to apply for a prior authorisation to process data about convictions and offences. Also, the CNIL has taken into consideration the specificities of the purposes sought by Chanel SA to interpret the French Data Protection Act, in particular, on the notice requirement and the access right.

The CNIL considered that the company’s legal obligation to inform data subjects must not prevent the company from preserving and defending its intellectual property rights. Thus, Chanel should not be required to inform the suspected infringers as provided by French Data Protection Law; i.e. in case of indirect data collection, notice must be provided at the time of recording. Notice can then be provided only once the measures necessary to preserve the evidence have been taken. This interpretation is in line with the CNIL decision on whistleblowing systems. In practice, Chanel SA will provide a general notice on its website, and it will send a specific notice to the individuals concerned in the letters requesting them to stop any infringing operation.

Data subjects have a right of access, but in case of a doubt about the legitimacy of the access request, the company will be entitled to ask for CNIL’s opinion on whether the information requested can be communicated.