Nov. 23, 2020

Interviews

Full reference: Frison-Roche, M.-A., Facebook: Quand le Droit de la Compliance démontre sa capacité à protéger les personnes (Facebook: When Compliance Law proves its ability to protect people), interview with Olivia Dufour, Actu-juridiques Lextenso, 23rd of November 2020

Read the interview (in French)

Read the news of the Newsletter MAFR - Law, Compliance, Regulation about this question

Nov. 18, 2020

Conferences

Full Reference: Frison-Roche, M.-A., Compliance Law, an adequate legal framework for GAIA-X, in "The World with GAIA-X", Pan-European GAIA - X Summit November 2020, 18 November 2020.

 

See the general presentation of the Summit.

 

Summary  of the intervention  in the Round-Table with professors Jacques Crémer and Achim Wambach:

Europe may offer an adequate legal framework for the GAIA-X project through Compliance Law. Compliance Law is a new forme a Regulatory Law, driven by "Monumental Goals", negative Monumental Goals, for instance prevention of systemic failures, and positive Monumental Goals, for instance innovation or stability. This very new branch of Law works on these Monumental Goals, which must be explicit and internalized in Crucial Enterprises. These Crucial Enterprises concretize these Goals, supervised by public Authorities. 

European Compliance Law already works, for instance about Personal Data protection (case law and GDPR) or prevention banking systemic failures (Banking Union), Compliance Tools being in balance with Competition principle. European Union Law is moving from the Ex Post Competition Law to the Ex Ante Compliance Law, internalizing Monumental Goals in Crucial Enterprises. 

There is a perfect adequacy between European Compliance Law and GAIA-X. This project built by Crucial Enterprises must be supervised by public authority, maybe a specific or the European Commission. The governance of GAIA-X must be transparent and accountable. This private organization must use it powers in respect of the proportionality principle, controlled by the public supervisory body. The legal framework is required but it is sufficient. 

___

See the slides, basis of this intervention.

 

See the video of this intervention. 

Nov. 1, 2020

Publications : Newsletter MAFR - Law, Compliance, Regulation

Full reference: Frison-Roche, M.-A., Due process and Personal Data Compliance Law: same rules, one Goal (CJEU, Order, October 29, 2020, Facebook Ireland Ltd v/ E.C.)Newsletter MAFR - Law, Compliance, Regulation, 1st of November 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Read Marie-Anne Frison-Roche's interview in Actu-juridiques about this decision (in French)

 

Summary of the news: 

As part of a procedure initiated for anti-competitive behaviors, the European Commission has three times requested, between the 13th of March and the 11th of November 2019, from Facebook the communication of information, reitarated in a decision in May 2020.  

Facebook contests it alleging that the requested documents would contain sensitive personal information that a transmission to the Commission would make accessible to a too broad number of observers, while "the documents requested under the contested decision were identified on the basis of wideranging search terms, (...) there is strong likelihood that many of those documents will not be necessary for the purposes of the Commission’s investigation". 

The contestation therefore evokes the violation of the principles of necessity and proportionality but also of due process because these probatory elements are collected without any protection and used afterwards. Moreover, Facebook invokes what would be the violation of a right to the respect of personal data of its employees whose the emails are transferred. 

The court reminds that the office of the judge is here constraint by the condition of emergency to adopt a temporary measure, acceptable by the way only if there is an imminent and irreversible damage. It underlines that public authorities benefit of a presumption of legality when they act and can obtain and use personal data since this is necessary to their function of public interest. Many allegations of Facebook are rejected as being hypothetical. 

But the Court analyzes the integrality of the evoked principles with regards with the very concrete case. But, crossing these principles and rights in question, the Court estimates that the European Commission did not respect the principle of necessity and proportionality concerning employees' very sensitive data, these demands broadening the circle of information without necessity and in a disproportionate way, since the information is very sensitive (like employees' health, political opinions of third parties, etc.). 

It is therefore appropriate to distinguish among the mass of required documents, for which the same guarantee must be given in a technique of communication than in a technic of inspection, those which are transferable without additional precaution and those which must be subject to an "alternative procedure" because of their nature of very sensitive personal data. 

This "alternative procedure" will take the shape of an examination of documents considered by Facebook as very sensitive and that it will communicate on a separate electronic support, by European Commission's agents, that we cannot a priori suspect to hijack law. This examination will take place in a "virtual data room" with Facebook's attorneys. In case of disagreement between Facebook and the investigators, the dispute could be solved by the director of information, communication and medias of the Directorate-General for Competition of the European Commission. 

___

We can draw three lessons from this ordinance: 

  1. This decision shows that Procedural Law and Compliance Law are not opposed. Some often say that Compliance guarantees the efficacy and that Procedure guarantees fundamental rights, the protection of the one must result in the diminution of the guarantee of the other. It is false. As this decision shows it, through the key notion of sensitive personal data protection (heart of Compliance Law) and the care for procedure (equivalence between communication and inspection procedures; contradictory organization of the examination of sensitive personal data), we see once again that two branches of Law express the same care, have the same objective: protecting people. 
  2. The judge is able to immediately find an operational solution, proposing "an alternative procedure" axed around the principle of contradictory and conciliating Commision's and Facebook's interests has shown that it was able to bring alternative solutions to the one it suspends the execution, appropriate solution to the situation and which equilibrate the interest of both parties. 
  3. The best Ex Ante is the one which anticipate the Ex Post by the pre-constitution of evidence. Thus the firm must be able to prove later the concern that it had for human rights, here of employees, to not being exposed to sanctioning pubic authorities. This Ex Ante probatory culture is required not only from firms but also from public authorities which also have to give justification of their action. 

 

__________

 

 

Oct. 22, 2020

Interviews

Full reference: Frison-Roche, M.-A., "Health Data Hub est un coup de maître du Conseil d'Etat", interview realized by Olivia Dufour for Actu-juridiques, Lextenso, 22nd of October 2020

Read the news of 19th of October 2020 of the Newsletter MAFR - Law, Compliance, Regulation on which relies this interview: Conditions for the legality of a platform managed by an American company hosting European health data​: French Conseil d'Etat decision 

To go further, on the question of Compliance Law concerning Health Data Protection, read the news of 25th of August 2020: The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection 

Oct. 19, 2020

Publications : Newsletter MAFR - Law, Compliance, Regulation

Full reference: Frison-Roche, M.-A., Conditions for the legality of a platform managed by an American company hosting European health data​: French Conseil d'Etat decisionNewsletter MAFR - Law, Compliance, Regulation, 19th of October 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

___

 

News Summary: In its ordinance of 13th of October 2020, Conseil national du logiciel libre (called Health Data Hub), the Conseil d'Etat (French Administrative Supreme Court) has determined the legal rules governing the possibility to give the management of sensitive data on a platform to a non-europeans firm, through the specific case of the decree and of the contract by which the management of the platform centralizing health data to fight against Covid-19 has been given to the Irish subsidiary of an American firm, Microsoft. 

The Conseil d'Etat used firstly CJEU case law, especially the decision of 16th of July 2020, called Schrems 2, in the light of which it was interpreted and French Law and the contract linking GIP and

The Conseil d'Etat concluded that it was not possible to transfer this data to United-Sates, that the contract could be only interpreted like this and that decree and contract's modifications secured this. But it observed that the risk of obtention by American public authorities was remaining. 

Because public order requires the maintenance of this platform and that it does not exist for the moment other technical solution, the Conseil d'Etat maintained the principle of its management by Microsoft, until a European operator is found. During this, the control by the CNIL (French Data Regulator), whose the observations has been taken into consideration, will be operated. 

We can retain three lessons from this great decision:

  • There is a perfect continuum between Ex Ante and Ex Post, because by a referred, the Conseil d'Etat succeed in obtaining an update of the decree, a modification of the contractual clauses by Microsoft and of the words of the Minister in order to, as soon as possible, the platform is managed by an European operator. Thus, because it is Compliance Law, the relevant time of the judge is the future. 
  • The Conseil d'Etat put the protection of people at the heart of its reasoning, what is compliant to the definition of Compliance Law. It succeeded to solve the dilemma: either protecting people thanks to the person to fight against the virus, or protecting people by preventing the centralization of data and their captation by American public authorities. Through a "political" decision, that is an action for the future, the Conseil found a provisional solution to protect people against the disease and against the dispossession of their data, requiring that an European solution is found. 
  • The Conseil d'Etat emphasized the Court of Justice of The European Union as the alpha and omega of Compliance Law. By interpreting the contract between a GIP (Public interest Group) and an Irish subsidy of an American group only with regards to the case law of the Court of Justice of European Union, the Conseil d'Etat shows that sovereign Europe of Data can be built. And that courts are at the heart of this. 

___________

 

Read the interview given on this Ordinance Health Data Hub

 

To go further about the question of Compliance Law concerning health data protection, read the news of 25th of August 2020: The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection 

 

Oct. 6, 2020

Thesaurus : 05. CJCE - CJUE

Full reference: CJEU, Grand Chamber, 6th of October 2020, Privacy International c/ Secretary of State for Foreign and Commonwealth Affairs, C-623/17.

Read the judgment 

Read the summary of the judgment (in French)

Read the opinion of the Advocate General 

Read the reference for a preliminary ruling from the Investigatory Powers Tribunal - London (United Kingdom)

Oct. 1, 2020

Thesaurus : Soft Law

Full reference of the guidelines: Commission Nationale de l'Informatique et des Libertés (CNIL), Délibération n°2020-091 du 17 septembre 2020 portant adoption de lignes directrices relatives à l'application de l'article 82 de la loi du 6 janvier 1978 modifiée aux opérations de lecture et écriture dans le terminal d'un utilisateur (notamment aux "cookies et autres traceurs") et abrogeant la délibération n°2019-093 du 4 juillet 2019 

Full reference of the recommendation: Commission Nationale de l'Informatique et des Libertés (CNIL), Délibération n°2020-092 du 17 septembre 2020 portant adoption d'une recommandation proposant des modalités pratiques de mise en conformité en cas de recours aux "cookies et autres traceurs". 

Read the guidelines (in French)

Read the recommendation (in French)

Read the presentation of these guilines and of this recommendation by the CNIL (in French) 

Read Marie-Anne Frison-Roche's comment about this in the Newsletter MAFR - Law, Regulation & Compliance of 1st of October 2020

Sept. 21, 2020

Law by Illustrations

This working paper is an extraction of an eponym newsletter published in the Newsletter MAFR - Law, Regulation & Compliance on 21st of September 2020 on LinkedIn.

Read the newsletter of 21st of September 2020

Sept. 10, 2020

Publications : Newsletter MAFR - Law, Compliance, Regulation

Full reference: Frison-Roche, M.-A., Responding to an email with "serious anomalies"​,transferring personal data, blocks reimbursement by the bank: French Cour de cassation, July 1st 2020Newsletter MAFR - Law, Compliance, Regulation, 10th of September 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

 

Summary of the news

"Phishing" is a kind of cyber criminality aiming to obtain, by sending fraudulent emails which look like to those sent by legitimate organisms, recipient's personal information in order to impersonate or steal him or her. As it is difficult to find the authors of "phishing" and to prove their intentionality in order to punish them directly, on mean to fight against "phishing" could be to entitle banks to secure their information network and, to accompany this obligation with a strong incentive, to convict them to reimburse the victims in case of robbery of their personal data.  

In 2015, a client victime of this kind of fraud asked to his bank, the Crédit Mutuel, to reimburse him the amount stole, what the bank refused to do on the grounds that the client committed a fault, transferring its confidential information without checking the email, however grossly counterfeit. The Court of first instance gave reason to the client because although he committed this fault, he was in good faith. This judgment was broken by the Chambre commerciale de la Cour de cassation (French Judicial Supreme Court) by a decision of 1st of July 2020 which states that this serious negligence, exclusive of any consideration of good faith, justifies the absence of reimbursement by the bank.

___

 

From this particular case, we can draw three lessons

  1. The Cour de Cassation states that good faith is not a salient criterion and that, as the bank must react when a banking account is objectively abnormal, the client must react face to an obviously abnormal email. 
  2. The Cour de Cassation describes the repartition of proof burden. Proof obligations are alternatively distributed between the bank and its client. First, the bank must secure its information network but, secondly, the client must take every reasonable measure to preserve its safety. It results from this that, if the email seems normal, phishing damages must be supported by the bank, and more generally of by the firm, while if the email is obviously abnormal, they must be supported by the client, but the burden to prove the abnormality of the email must be supported by the firm and not by the client. 
  3. Such a proof system shows that Compliance Law includes a pedagogic mission by educating each client in order to he or she would be able to distinguish among his or her emails, those which are normal and those which are obviously suspect. This pedagogic dimension, with the legal consequences associated to it, will not stop to spread. 

 

______

Sept. 2, 2020

Publications : Newsletter MAFR - Law, Compliance, Regulation

Full reference: Frison-Roche, M.-A., For regulating or supervising, technical competence is required: example of the French creation of the "Pôle d'expertise de la régulation numérique"​Newsletter MAFR - Law, Regulation, Compliance, 2nd of September 2020

Lire par abonnement gratuit d'autres news de la Newsletter MAFR - Law, Regulation, Compliance

Aug. 31, 2020

Publications : Newsletter MAFR - Law, Compliance, Regulation

Full reference: Frison-Roche, M.-A., Compliance by Design, a new weapon? Opinion of Facebook about Apple new technical dispositions on Personal Data protectionNewsletter MAFR - Law, Compliance, Regulation, 31st of August 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Aug. 27, 2020

Publications : Newsletter MAFR - Law, Compliance, Regulation

Full reference: Frison-Roche, M.-A., "Interregulation"​ between Payments System and Personal Data Protection: how to organize this "interplay"​?Newsletter MAFR - Law, Compliance, Regulation, 27th of August 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

Aug. 21, 2020

Publications : Newsletter MAFR - Law, Compliance, Regulation

Full reference: Frison-Roche, M.-A., Being obliged by Law to unlock telephone is not equivalent to self-incrimination: Cour de cassation, Criminal Chamber, Dec. 19, 2019Newsletter MAFR - Law, Compliance, Regulation, 21st of August 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

To go further, read Marie-Anne Frison-Roche's working paper: Rethinking the world from the notion of data

 

 

Sept. 21, 2016

Publications

Ce working paper sert de base à une conférence qui a lieu à Bordeaux le 23 septembre 2016.

Dans sa recommandation n°11, le rapport Lévy-Jouyet recommande la mise en ligne des données publiques pour améliorer le service public (open data), son financement se faisant au besoin par la publicité. C’est à un autre titre que par sa recommandation n°12, le rapport préconise d’aider la diffuser de la création française à l’étranger.

Dans une économie de l’immatériel devenue une « économie de l’accès », ces deux recommandations pourraient se rapprochent, se fondre peut-être. En effet, si l’on relit par exemple les « lieux de mémoires » de Pierre Nora, on observe que les personnes publiques portent le patrimoine immatériel de la France. Il est d’une grande valeur. Il a été créé notamment par l’Histoire. L’État en organise l’accès, par l’open data. En cela, il organise l’accès à une création collective. En cela, il remplit sa fonction de satisfaire le bien commun d’ouverture.

Mais l'on bute rapidement sur une difficulté, voire une aporie : comme l'exprime le rapport Lévy-Jouyet pour les données publiques l’accès à celles-ci doit être financé. De la même façon, l’accès aux "lieux de mémoires doit être financé". Et l'on voit à travers cette question financière la contradiction de l'open data : L’enrichissement par les opérateurs de l’accès sans aucune contrepartie est incompréhensible. Seule une licence de droit commun peut rétablir le caractère commutatif entre le dépositaire de la création immatérielle collectif qui est la personne publique qui perdure dans le temps (l’État) et celui qui tire profit de l’accès.  Puisque chacun sait que la gratuité n’est pas un système sain, tandis que chacun dit que les licences open data ne sont pas effectives.

C'est pourquoi il convient d'examiner les règles juridiques qui gouvernent aujourd'hui ce que l'on appelle "l'open data" comme l'expression d'un droit d'accès à ce qui est à tout le monde mais qui est pourtant intouchable (I), le régime juridique montrant les contradictions de l'open data, ce à quoi le droit plus classique auquel le rapport renvoie par ailleurs pourrait répondre (II)

Updated: June 18, 2016 (Initial publication: Nov. 8, 2015)

Publications

This Working paper will be used to support an  French written article to be published in a book, set in the media/assets/couvertures/couverture-internet-espace-dinterregulation.0.pdf">Regulations Series, Dalloz Publishing

This working paper was the basis for intervention in the symposium organized by the internet-espace-/">Journal of Regulation, Internet, Space of Interregulation.

View the slides used as support at the conference (in French).

____

 

After emphasizing that the concept of "data" is uncertain, the first perspective is to draw the regulatory consequences of the fact that what is often referred to as the "object" of the data item (the person, the company for financial data, the economy for rating data, etc.), is only its source, "underlying", the data which is manufactured by a company : the real objet of the data is  its purpose being the use for which the data is intended. The data is independent its underlying, is consolidated in the affected masses, takes an economic value based on the desires that have users, becomes available outside of time and space in the digital. This implies a specific interregulation.

But the data is also the Janus of digital because new black gold, pure financial instrument, immaterial by nature, the data also keep a record of people, the underlying that would protect, that we would like inseparable, or the structure that one would want legitimately to attack thank to the new mechanism of compliance. This double-sided of the data item leads to shocks of regulatory mechanisms in Internet

In addition, any Internet links back to the user, in whom we would gladly see "The Grand Interregulato" ". But is it so appropriate, legitimate and effective? The "consent" which refers this interregulation provided by the user himself raises doubts. However, as the displaced term of "right to be forgotten" hides a very effective weapon that can strike those who monopolize the data in a digital economy that seems to be in an ante-market mechanism. This regression pulverizes the marketself-regulation itself to replace the legal acts of exchange by connective legal acts, that for now Law and Regulation are struggling to understand, lack of legal qualifications to do so.

 

Updated: March 12, 2016 (Initial publication: Nov. 7, 2015)

Publications

Law is a reconstruction of the world through definitions and categories, expressed in words, to which are imputed rules. There is always a share of invention in Law, articulated to a share of fidelity to the concrete world that it retranscribes, a combination enabling Law to regulate the latter.

Law is put in difficulty by what the term "data", quite new, is not easy to define. The fact that it is strangely formulated in Latin to show that there is plurality, the data, before associating it with an English adjective when there are many, the "big data", does not advance us more on what a "data" is. Law is a practical art that works well only if it manipulates categories whose definition is mastered.

This is why, in a first stage, we must recognize the uncertainties of the very notions of "data" (I), in order to orientate the adequate rules in the second step towards what is a given, namely a "pure" value in our consumer information society (II).

 

Read the article written in French on the basis à this working paper

May 27, 1998

Thesaurus : Doctrine

Référence complète : Catala, P., La propriété de l'information,  in Le droit à l'épreuve du numérique. Jus ex Machina, coll. "Droit, Éthique, Société",  PUF , Paris, 1998, p.245-262

 

Lire l'article.

 

Les étudiants de Sciences-po peuvent consulter l'article par le drive dans le dossier " MAFR- Régulation".