FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
decisions cannot rely on sensitive data unless very specific legal conditions are met, and reinforced pro - tective measures are in place. In addition, the SREN Law and DSA prohibit the pres - entation of advertisements based on profiling using special categories of personal data (eg, political opin - ions, health). Targeting minors with profiling-based ads is also strictly banned. Transparency Under the DSA, online platforms must ensure adver - tisements are clearly identifiable and provide, directly from the advert itself, meaningful information about the main parameters used to determine why the recipient is being shown the ad, and where applica - ble, information on how to change those parameters. Direct Marketing Under Article L 34-5 of the CPCE, electronic marketing (email, SMS) requires prior opt-in consent, unless the recipient is an existing customer for similar products/ services or is a professional (B2B) being contacted on a work address. 4.3 Employment Privacy Law In France, there is no single “employment privacy act”. Employment privacy is governed by the GDPR and the FDPA, overseen by the CNIL. Importantly, it is also framed by French Labour Code rules (notably propor - tionality and information/consultation requirements). For instance, the Labour Code expressly states that no personal information may be collected through a device that has not been brought to the employee’s attention beforehand, and the employees’ representa - tive body ( Lecomité social et économique – CSE) must be informed/consulted in advance on employee moni - toring tools and methods. Key Themes Related to Privacy in the Workplace Employee monitoring Monitoring (eg, time tracking, CCTV, IT logs, geoloca - tion) must be necessary, proportionate and disclosed. For vehicle geolocation, the CNIL indicates that the employer should not track outside working time and information collected should not be used to calculate working time when another method already exists. A CNIL fine published on 4 February 2025 (“inactivity”
scoring, frequent screenshots, permanent filming) shows where monitoring crosses the line, and high- risk/constant monitoring may trigger a DPIA. Remote work Remote work is defined in Labour Code Article L1222- 9 and is usually set by a collective agreement or, failing that, an employer charter after consulting the CSE; it may also be agreed individually. The CNIL highlights reinforced security for telework and configuring tools to minimise data collected. Communication tools at work The CNIL notes that employers may control internet and email use for security and policy enforcement but must set rules and inform employees (often via an IT charter). For bring your own device (BYOD), the CNIL recommends separating professional from pri - vate spaces; remote wiping should be limited to the professional space, not the whole personal device. Recruitment The CNIL’s guide requires collecting only data that is strictly necessary to assess candidates, providing GDPR notices, and defining retention. The CNIL indi - cates that an unsuccessful candidate’s file may be kept for a short period (eg, up to about three months) to manage feedback/contestation, and then up to two years after the last contact only if the candidate is clearly informed and has agreed or can easily object. Background checks must be job-relevant – a criminal record extract (Bulletin No 3) may be requested only in limited, justified cases and should be consulted but not retained; where an authority grants approval, that approval generally suffices. 4.4 Data Protection in M&A Under the EU GDPR and the FDPA, there is no “M&A carve-out” – any disclosure, transfer and reuse of per - sonal data must be lawful, transparent, proportionate and secure. The following key principles must be fol - lowed: • Due diligence/data room – disclose only what is necessary (data minimisation), and use strict access controls, logging and NDAs; avoid special- category data unless strictly needed.
125 CHAMBERS.COM
Powered by FlippingBook