FRANCE Law and Practice Contributed by: Frédéric Sardain and Claire Allavena, Jeantet
• how long cookies will be stored on the web user’s device; and • how web users can manage their cookie preferences, including how to delete cookies or opt out. In summary, the requirements for using cookies in France emphasise the necessity of obtaining informed and explicit consent from web users, providing transparency about cookie usage, and ensuring that web users can easily manage their cookie preferences. Thus, organisations operat - ing websites within France need to comply with these requirements. 4.2 Personalised Advertising and Other Online Marketing Practices The FDPA primarily shapes the French legal landscape regarding online personalised adver - tising, the ePrivacy Directive and the CNIL’s guidelines on cookie use. Over the past few years, personalised adver - tising has been at the heart of numerous com - plaints lodged with the CNIL. Recently, the CNIL severely punished organisations that use per - sonalised advertising without the consent of web users: DOCTISSIMO (2023) – EUR100,000 and YAHOO! (2023) – EUR10 million. To respect data protection principles, organi - sations shall notably have a valid lawful basis for processing personal data for personalised online advertising purposes. In such cases, explicit consent is required to track web users across websites (eg, through cookies) in order to provide such web users with personalised content. Web users shall also be informed about the use of such tracking mechanisms. Moreover, web users shall be able to exercise their right to object to the use of their personal data for personalised advertising at any time.
The French legal landscape establishes a com - prehensive set of regulations companies must navigate when engaging in personalised adver - tising. Compliance with consent requirements and transparency obligations is essential for
advertisers operating in France. 4.3 Employment Privacy Law
Data protection and privacy laws in France sig - nificantly influence the employment relationship, particularly in how employers collect, process, and manage employee personal data. Regarding transparency, employers are required to provide clear and transparent information to employees about the purposes of data process - ing, the categories of data collected, the recipi - ents of the data collected, and how long such data will be retained. In this regard, employers must issue privacy notices to employees outlin - ing such information and informing them of their rights concerning their personal data. Regarding the legal basis for processing, while consent can be a valid basis for processing personal data, it must be freely given, specif - ic, informed, and unambiguous, which can be challenging in employment relationships where power dynamics exist. This is why, in France, consent is not the preferred legal basis for pro - cessing employee data. In practice, consent is required for the use of employee images, but other purposes are mainly based on contract performance, legitimate interest or compliance with a legal obligation. Regarding monitoring, employers may be tempt - ed to monitor employees’ activities (eg, email and internet usage, CCTV, working time, and phone call recording) in the workplace. However, such monitoring must comply with data protec - tion and privacy laws and be justified as neces -
134 CHAMBERS.COM
Powered by FlippingBook