On March 23, the Conseil d'Etat (the highest court in France for administrative cases) upheld a decision of the French Data Protection Authority (CNIL) of 12 January 2012 pronouncing a 20,000-euro fine against a real estate company for unlawfully sending marketing messages to individuals by SMS without obtaining their prior consent at the time of collection of their mobile phone numbers, lack of prior information and the absence of an opt-out option in the messages that were sent. This decision follows an on-site inspection by the CNIL on the company's premises and the delivery of a notice of enforcement with which the company did not comply. The court ruled that the CNIL's sanction was not disproportionate to the facts and confirmed the CNIL's decision. The court also upheld the CNIL's decision to issue a public release about the sanction it pronounced against this company.
The company in question was sanctioned on three grounds.
First, the company was sanctioned for unlawfully collecting thousands of phone numbers from real estate announcements posted by users on the Internet and then using them to send them marketing messages by SMS marketing under article L.34-5 of the Postal and Electronic Communications Code.
Second, the court considered that the company did not provide prior notice to users about the processing of their personal data, in violation of Section 32 of the French Data Protection Act. Indeed, controllers must inform the data subjects about the processing of their personal data, unless the data subject has already been informed or this would involve disproportionate efforts. In this case, the data was not collected directly from users, but the court considered that the company did not provide any evidence that informing the individuals was either impossible, or required disproportionate effort.
Lastly, the court ruled that the individuals were not provided with an option to opt out as required by Article 38 of the Data Protection Act. In the given case, the right to opt out was conditioned to the user sending an SMS or making a phone call—both of which were charged to the individual—or completing an online form on the company's website, which required the individual to provide further data.
If you want to comment on this post, you need to login.