FRANCE Law and Practice Contributed by: Frédéric Sardain and Claire Allavena, Jeantet
As the use of AI and digital technologies prolifer - ates, litigation surrounding challenges such as algorithmic bias, data subject rights in automat - ed decision-making, and transparency require - ments is likely to increase. Impact of Supranational/International Developments on Domestic Litigation Decisions made by the ECJ regarding data pro - tection and privacy, such as those on the validity of the Privacy Shield, the interpretation of fun - damental rights under EU law or, more recently, on compensation for moral prejudice,, in the event of a breach of data protection and privacy laws, may have direct implications for domestic litigation. Such rulings inform courts in France and help shape legal interpretations concerning privacy matters. Influence of the European Data Protection Board (EDPB): the EDPB can adopt opinions to ensure consistent application of the GDPR and binding decisions to settle disputes between supervisory authorities in the EU referred to it. The European Commission has a key role to play especially in personal data transfers outside the EU, in international cooperation or in relation to EDPB missions. France’s obligations under international treaties, like the European Convention on Human Rights (ECHR), which guarantees the right to respect for private and family life, influence the judicial landscape around privacy litigation. French courts often consider these obligations when adjudicating privacy-related cases. The activities of major technology companies, particularly concerning the handling of personal data, have sparked litigation not only in France but also across Europe and globally. Develop -
ments and regulatory measures taken against these companies (eg, fines or compliance orders) can create a ripple effect domestically,
prompting similar litigation. 2.2 Recent Case Law
CJEU Case Law on Articles 82 of the GDPR Article 82 of the GDPR allows individuals to claim damages (both material and non-material) from organisations violating their data protec - tion rights. Recent CJEU rulings clarify that com - pensation is required for all damages resulting from GDPR infringements. To successfully claim damages under Article 82, three conditions must be met: a fault by the organisation, demon - strable damage to the individual, and a causal link between the fault and the damage. French courts apply this principle, consistent with the French civil code, requiring justification for the claimed damages even when a GDPR violation is established. CJEU Case Law on the Impact of a GDPR Breach on Unfair Commercial Practices The CJEU recently ruled that violations of the GDPR can also be considered unfair commercial practices under national laws. This means com - petitors can sue companies for GDPR violations if they give them an unfair competitive advan - tage. The CJEU’s decision supports existing French case law, in which courts have already considered non-compliance with the GDPR to be a form of unfair competition. CJEU Case Law on the Retention of Metadata and Login Data The CJEU ruled that French legislation allowing generalised and indiscriminate storage of traffic and location data by internet service providers violated EU law. The CJEU held that such data retention is only permissible for serious crimes and requires prior authorisation from a court or
129 CHAMBERS.COM
Powered by FlippingBook