Food for thoughts

Full reference: Frison-Roche, M.-A., Due process and Personal Data Compliance Law: same rules, one Goal (CJEU, Order, October 29, 2020, Facebook Ireland Ltd v/ E.C.), Newsletter MAFR - Law, Compliance, Regulation, 1st of November 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Read Marie-Anne Frison-Roche's interview in Actu-juridiques about this decision (in French)

Summary of the news: 

As part of a procedure initiated for anti-competitive behaviors, the European Commission has three times requested, between the 13th of March and the 11th of November 2019, from Facebook the communication of information, reitarated in a decision in May 2020.  

Facebook contests it alleging that the requested documents would contain sensitive personal information that a transmission to the Commission would make accessible to a too broad number of observers, while "the documents requested under the contested decision were identified on the basis of wideranging search terms, (...) there is strong likelihood that many of those documents will not be necessary for the purposes of the Commission’s investigation". 

The contestation therefore evokes the violation of the principles of necessity and proportionality but also of due process because these probatory elements are collected without any protection and used afterwards. Moreover, Facebook invokes what would be the violation of a right to the respect of personal data of its employees whose the emails are transferred. 

The court reminds that the office of the judge is here constraint by the condition of emergency to adopt a temporary measure, acceptable by the way only if there is an imminent and irreversible damage. It underlines that public authorities benefit of a presumption of legality when they act and can obtain and use personal data since this is necessary to their function of public interest. Many allegations of Facebook are rejected as being hypothetical. 

But the Court analyzes the integrality of the evoked principles with regards with the very concrete case. But, crossing these principles and rights in question, the Court estimates that the European Commission did not respect the principle of necessity and proportionality concerning employees' very sensitive data, these demands broadening the circle of information without necessity and in a disproportionate way, since the information is very sensitive (like employees' health, political opinions of third parties, etc.). 

It is therefore appropriate to distinguish among the mass of required documents, for which the same guarantee must be given in a technique of communication than in a technic of inspection, those which are transferable without additional precaution and those which must be subject to an "alternative procedure" because of their nature of very sensitive personal data. 

This "alternative procedure" will take the shape of an examination of documents considered by Facebook as very sensitive and that it will communicate on a separate electronic support, by European Commission's agents, that we cannot a priori suspect to hijack law. This examination will take place in a "virtual data room" with Facebook's attorneys. In case of disagreement between Facebook and the investigators, the dispute could be solved by the director of information, communication and medias of the Directorate-General for Competition of the European Commission. 

___

We can draw three lessons from this ordinance: 

1. This decision shows that Procedural Law and Compliance Law are not opposed. Some often say that Compliance guarantees the efficacy and that Procedure guarantees fundamental rights, the protection of the one must result in the diminution of the guarantee of the other. It is false. As this decision shows it, through the key notion of sensitive personal data protection (heart of Compliance Law) and the care for procedure (equivalence between communication and inspection procedures; contradictory organization of the examination of sensitive personal data), we see once again that two branches of Law express the same care, have the same objective: protecting people. 
2. The judge is able to immediately find an operational solution, proposing "an alternative procedure" axed around the principle of contradictory and conciliating Commision's and Facebook's interests has shown that it was able to bring alternative solutions to the one it suspends the execution, appropriate solution to the situation and which equilibrate the interest of both parties. 
3. The best Ex Ante is the one which anticipate the Ex Post by the pre-constitution of evidence. Thus the firm must be able to prove later the concern that it had for human rights, here of employees, to not being exposed to sanctioning pubic authorities. This Ex Ante probatory culture is required not only from firms but also from public authorities which also have to give justification of their action. 

__________

Full reference: Frison-Roche, M.-A., "Health Data Hub est un coup de maître du Conseil d'Etat", interview realized by Olivia Dufour for Actu-juridiques, Lextenso, 22nd of October 2020

Read the news of 19th of October 2020 of the Newsletter MAFR - Law, Compliance, Regulation on which relies this interview: Conditions for the legality of a platform managed by an American company hosting European health data​: French Conseil d'Etat decision 

To go further, on the question of Compliance Law concerning Health Data Protection, read the news of 25th of August 2020: The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection 

Full reference: Frison-Roche, M.-A., Conditions for the legality of a platform managed by an American company hosting European health data​: French Conseil d'Etat decision, Newsletter MAFR - Law, Compliance, Regulation, 19th of October 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

___

News Summary: In its ordinance of 13th of October 2020, Conseil national du logiciel libre (called Health Data Hub), the Conseil d'Etat (French Administrative Supreme Court) has determined the legal rules governing the possibility to give the management of sensitive data on a platform to a non-europeans firm, through the specific case of the decree and of the contract by which the management of the platform centralizing health data to fight against Covid-19 has been given to the Irish subsidiary of an American firm, Microsoft. 

The Conseil d'Etat used firstly CJEU case law, especially the decision of 16th of July 2020, called Schrems 2, in the light of which it was interpreted and French Law and the contract linking GIP and

The Conseil d'Etat concluded that it was not possible to transfer this data to United-Sates, that the contract could be only interpreted like this and that decree and contract's modifications secured this. But it observed that the risk of obtention by American public authorities was remaining. 

Because public order requires the maintenance of this platform and that it does not exist for the moment other technical solution, the Conseil d'Etat maintained the principle of its management by Microsoft, until a European operator is found. During this, the control by the CNIL (French Data Regulator), whose the observations has been taken into consideration, will be operated. 

We can retain three lessons from this great decision:

• There is a perfect continuum between Ex Ante and Ex Post, because by a referred, the Conseil d'Etat succeed in obtaining an update of the decree, a modification of the contractual clauses by Microsoft and of the words of the Minister in order to, as soon as possible, the platform is managed by an European operator. Thus, because it is Compliance Law, the relevant time of the judge is the future. 
• The Conseil d'Etat put the protection of people at the heart of its reasoning, what is compliant to the definition of Compliance Law. It succeeded to solve the dilemma: either protecting people thanks to the person to fight against the virus, or protecting people by preventing the centralization of data and their captation by American public authorities. Through a "political" decision, that is an action for the future, the Conseil found a provisional solution to protect people against the disease and against the dispossession of their data, requiring that an European solution is found. 
• The Conseil d'Etat emphasized the Court of Justice of The European Union as the alpha and omega of Compliance Law. By interpreting the contract between a GIP (Public interest Group) and an Irish subsidy of an American group only with regards to the case law of the Court of Justice of European Union, the Conseil d'Etat shows that sovereign Europe of Data can be built. And that courts are at the heart of this. 

___________

Read the interview given on this Ordinance Health Data Hub

To go further about the question of Compliance Law concerning health data protection, read the news of 25th of August 2020: The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection 

Full reference: Serious Fraud Office, Operational Handbook about Deferred Prosecution Agreements, October 2020

Read the Operational Handbook

Full reference: Frison-Roche, M.-A., Et si le secret de l’avocat était l’allié de la lutte contre le blanchiment ?, interview realized by Olivia Dufour for Actu-juridiques, Lextenso, 15th of October 2020

Read the interview (in French)

To go deeper on the place of the attorney in Compliance Law, read Marie-Anne Frison-Roche's working paper: The Attorney, Vector of Conviction in the New Compliance System

Full reference: Tribunal judiciaire de Paris, 9th of October 2020, Ordonnance de référé, Veolia/Suez, N° RG 20/56077

Read the ordonnance de référé (in French)

Full Reference : Frison-Roche, M.-A.,Attorney's Professional Secret & Filter mechanism in balance with fighting Money Laundering: constitutional analysis in favor of Attorney's Secret, Newsletter MAFR - Law, Compliance, Regulation, October 9, 2020.

Summary: By its judgment of September 24, 2020, the Constitutional Court of Belgium released an essential judgment which considers:
- Compliance Law which imposes obligations on entities to fight against money laundering and the financing of terrorism is legal requirements which must be analyzed on the basis of these goals
- the national transposition law is "broader" than the transposed European texts since it is anchored in the Constitution
- the provisions of the law imposing the declaration of suspicion on an employee of the Attorney or on a Compliance Officer concerning information covered by the professional secrecy of the Attorney, the basis of Democracy, must therefore be canceled.
This reasoning is remarkable and very solid.
It is not unique to Belgium.

Lire par abonnement gratuit les autres News dans la Newsletter MAFR - Law, Compliance, Regulation

Full reference: CJEU, Grand Chamber, 6th of October 2020, Privacy International c/ Secretary of State for Foreign and Commonwealth Affairs, C-623/17.

Read the judgment 

Read the summary of the judgment (in French)

Read the opinion of the Advocate General 

Read the reference for a preliminary ruling from the Investigatory Powers Tribunal - London (United Kingdom)

Full reference: Baer, B., Proposals to Strengthen the Antitrust Laws and Restore Competition Online, Testimony before the United-States House of Representatives, Committee on Judiciary, Subcommittee on Antitrust, Commercial and Administrative Law, 1st of October 2020

Read the testimony

Read Bill Baer's presentation by Brookings Institution of which he is a member

Full reference: Frison-Roche, M.-A., Judge between Platform and Regulator: current example of Uber case in U.K., Newsletter MAFR - Law, Compliance, Regulation, 29th of September 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news:

On 22nd of September 2017, Transport of London (TFL), London Transport Regulator, refused to renew the licence, granted on 31st of May 2012 for 5 years, authorizing Uber to transport people because of criminal offenses committed by Uber's drivers. On 26th of June 2018, The Westminster Court prolonged Uber's licence for 15 months under the condition that the platform prevent the reproachable behaviors of its drivers. After these 15 months, the TFL refused once again to prolonge Uber's licence because of the persistence of aggressions against passengers. Uber, once again, contest this decision before the Westminster Court. 

In a decision of 28th of September 2020, the Court observes that during the 15 months, the platform implemented many measures to prevent aggressions, that the level of maturity of these measures has improved over time and that the number of offenses was reduced over the period (passing from 55 in 2018 to 4 in 2020). The Court estimated the the implementation of this actions is sufficient to grant a new licence to Uber. 

We can learn three lessons from this decision: 

1. The Compliance obligation is not a result obligation but a mean obligation, which means that it is not reasonable to expect from a crucial operator (Uber, for instance) that it prevent every cases of agression but that it is salient to judge it on the effort it deploys to try to be closer to this ideal situation. Moreover, the crucial operator must be proactive, that is going away from the figure of passive subject of Law who apply measures enacted by the regulator in terms of fighting against aggressions to be an actor of the research of the best way to fight abusive behaviors, internalizing this "monumental goal. 
2. The judge appreciates the violation committed by those whose the firm is responsible "in context", that is evaluates the concrete situation in a reasonable way. 
3. It is the judge who decides in last resort and like the crucial operator, it must be reasonable. 

Read to go further:

• Frison-Roche, M.-A., Firm, Regulator and Judge: thinking Compliance through these three characters, 2018
• The report of the Assemblée nationale (French Parliament chamber) on the question 

Full reference: Westminster Magistrates' Court, 28th of September 2020, Uber London Limited v. Transport for London 

Read the decision

Read Marie-Anne Frison-Roche's commentary in the Newsletter MAFR - Law, Regulation & Compliance 

Référence complète : Frison-Roche, M.-A., "Plus le monde est dérégulé, et plus on a besoin de régulation", Journal du Dimanche - JDD, 27 septembre 2020. 

Lire l'entretien en ligne

Les questions étaient les suivantes :

Comment définissez-vous les professions réglementées?
Un "titre" y est apposé sur les personnes, avocat, dentiste, ­notaire, etc. Ça fonctionne comme un certificat. Comme en finance – produits financiers "certifiés" – ou dans l'alimentation – aliments "certifiés" –, ce titre est un gage de traçabilité : il crédite aux yeux de tous la personne d'une compétence qu'il n'est a priori pas nécessaire de vérifier. Ces professions structurées sont des piliers de la vie économique et sociale car les accréditeurs [autorités publiques ou instances professionnelles] garantissent l'indépendance et le dévouement du professionnel. Ainsi l'adjectif "réglementées" parvient sans doute mal à définir à lui seul ces professions. Je parlerais plutôt de "professions publiquement structurées".

Est-ce un système qui a de l'avenir?
Oui, très grand ! Dans un monde ouvert qui cherche ses repères et sa stabilité, les professions réglementées, parce qu'elles sont structurées et structurantes, seront essentielles. Ainsi, plus le monde est dérégulé, plus on a besoin de régulation ! Le paradoxe n'est qu'apparent. Il faut arrêter ­d'opposer marché et État. Moins il y a de réglementations fixes, plus on a besoin de repères. Par exemple, j'arrive dans un pays étranger et j'ai un problème de droit : mon premier réflexe sera de trouver un avocat, en qui j'aurai confiance du fait de son titre, qui valide a priori ses compétences et son intégrité.

Les professions réglementées ont été attaquées, presque cernées, par le droit de la concurrence

Nous vivons visiblement le contraire, avec l'explosion de sites d'avis et de conseils…
Justement, voilà la question de la source, de savoir qui certifie : ici ce sont les clients ou des amis des clients, il n'y a plus de distinction entre le certificateur et ­l'utilisateur. Cette absence de distance produit une ­capture et la perte ­catastrophique d'une ­exigence clé de tout ­système évolué : ­l'impartialité et ­l'indépendance de celui qui juge.

Comment les professions réglementées ont-elles évolué ces dernières années?
Elles ont été attaquées, presque cernées, par le droit de la concurrence. La direction de la concurrence de la Commission européenne ou l'Autorité de la concurrence en France tenaient le raisonnement suivant : les ­diplômes spécifiques exigés et les structures ­professionnelles ­verrouillent le secteur, il faut ­l'aérer. Ce droit conçoit la ­régulation comme une transition vers la concurrence et non comme un équilibre entre concurrence et, par exemple, le souci de la personne. Les professions dites "réglementées" sont au contraire structurées pour maintenir cet équilibre entre le dynamisme de la concurrence et l'humanisme du droit. Sur ce point, avocats et notaires doivent unir leurs forces.

Quelle vision avez-vous de la réforme Macron, entamée il y a cinq ans?
Elle est allée dans le sens de la concurrence, mais avec en filigrane une perspective de régulation définitive et non une transition avec un marché du droit pur et simple. Les instances de la concurrence conçoivent sans doute la société à travers le seul prisme du ­marché concurrentiel, mais l'Europe s'en détache de plus en plus. Il y a ­aujourd'hui l'ambition de construire une Europe souveraine qui ne peut pas être simplement concurrentielle. Les professions réglementées ont en ce sens un rôle essentiel à jouer, notamment par l'accélération de leur transition numérique, souhaitée pour les avocats et par le rapport Perben, et mise en oeuvre par les notaires.

Full reference: Frison-Roche, M.-A., Regulation, Compliance & Cinema: learning about Internet Regulation with the series "Criminals"​, Newsletter MAFR - Law, Compliance, Regulation, 21st of September 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news: 

Season 2 Episode 3 of the British version of the series "Criminals" features the character of Danielle. Danielle is a mother which has decided to hunt down pedophiles on social networks in order to trap them and show to the world their acts. Danielle insists on the efficiency of her action with regard to the police and justice that she finds unproductive. In the episode, Danielle is accused of defamation by the police. While policemen try to explain to Danielle the importance of using a regular procedure and to respect the Rule of Law aiming to prove its accusations, she makes efficiency her only principle. According to her, her methods get results (on the contrary of those used by the police which respect procedures) and those she accuses to be pedophiles do not deserve defense rights. 

We can learn three lessons from Danielle's story: 

1. If Compliance Law is just a process of application of mechanical rules, then Rule of Law is not salient face to the principle of efficiency. But, if Compliance Law is defined by its "monumental goals" and that the respect of Rule of Law is erected in "monumental goal", then efficiency and Rule of Law become compatible and congruent. 
2. The digital space must be disciplined by crucial digital firms supervised by public authorities, like in France or Germany for hate speeches and disinformation. 
3. Compliance Law, and Law in general, must be pedagogue towards individuals as Danielle which do not understand why their behaviors are reproachable. 

Full reference: Frison-Roche, M.-A., Responding to an email with "serious anomalies"​,transferring personal data, blocks reimbursement by the bank: French Cour de cassation, July 1st 2020, Newsletter MAFR - Law, Compliance, Regulation, 10th of September 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

"Phishing" is a kind of cyber criminality aiming to obtain, by sending fraudulent emails which look like to those sent by legitimate organisms, recipient's personal information in order to impersonate or steal him or her. As it is difficult to find the authors of "phishing" and to prove their intentionality in order to punish them directly, on mean to fight against "phishing" could be to entitle banks to secure their information network and, to accompany this obligation with a strong incentive, to convict them to reimburse the victims in case of robbery of their personal data.  

In 2015, a client victime of this kind of fraud asked to his bank, the Crédit Mutuel, to reimburse him the amount stole, what the bank refused to do on the grounds that the client committed a fault, transferring its confidential information without checking the email, however grossly counterfeit. The Court of first instance gave reason to the client because although he committed this fault, he was in good faith. This judgment was broken by the Chambre commerciale de la Cour de cassation (French Judicial Supreme Court) by a decision of 1st of July 2020 which states that this serious negligence, exclusive of any consideration of good faith, justifies the absence of reimbursement by the bank.

___

From this particular case, we can draw three lessons: 

1. The Cour de Cassation states that good faith is not a salient criterion and that, as the bank must react when a banking account is objectively abnormal, the client must react face to an obviously abnormal email. 
2. The Cour de Cassation describes the repartition of proof burden. Proof obligations are alternatively distributed between the bank and its client. First, the bank must secure its information network but, secondly, the client must take every reasonable measure to preserve its safety. It results from this that, if the email seems normal, phishing damages must be supported by the bank, and more generally of by the firm, while if the email is obviously abnormal, they must be supported by the client, but the burden to prove the abnormality of the email must be supported by the firm and not by the client. 
3. Such a proof system shows that Compliance Law includes a pedagogic mission by educating each client in order to he or she would be able to distinguish among his or her emails, those which are normal and those which are obviously suspect. This pedagogic dimension, with the legal consequences associated to it, will not stop to spread. 

______

Full reference: Frison-Roche, M.-A., Freedom&Media: when Italian Media Regulation's real "goal"​ is not Pluralism Protection, Freedom of Establishment prevails (CJEU, 3 Sept.2020,Vivendi), Newsletter MAFR - Law, Regulation, Compliance, 9th of September 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Regulation, Compliance

Summary of the news

The media sector is organized on an equilibrium between the principle of competition and other concerns like information pluralism. Generally, competition Law by making market accessible to many competitors ensures information pluralism. But, this is not the case if an operator get an excessive market power, running risk not only for competition but also for information pluralism. It is the reason why the Italian legal system forbids the constitution of an operator gathering more than 40% of the total income generated by the media sector or more than 10% of the total income generated by the Italian communication sector. 

In 2016, Vivendi, a French media group, got more than 28% of the Mediaset Group's actions and around 30% of its voting right. The Italian communication regulation authority sized by Mediaset demands in 2017 to Vivendi to ends its participations in the group Mediaset. Vivendi contested this decision before the regional administrative court which referred to the Court of Justice of the European Union in order to know if freedom of establishment can legitimately be discarded in favor of information pluralism in this concrete case. The Court of Justice answered, in a decision of 3rd of September 2020, that the restriction of the freedom of establishment can in principle be justified by a general interest objective such as information pluralism protection but that in this concrete case, this is not justified because the fact that a firm is committed in the transmission of contents does not necessarily give it the power to control the production of such contents.

We can learn three lessons form this case:

1. The Court precises that even if the principle is the freedom of establishment, it is possible to discard it to protect information pluralism protection under the condition that the concerned member State do not use this legitimate power to create a political monopoly, the burden of proof falling on the person attacking national legislation and not on the Member State.
2. The Court distinguishes transmission of contents and production of contents and explains that if the State rejects this decision, the burden falling to it to prove the concrete links between these two activities.
3. This case shows that the power to share the respective places of the "principle" and of the "exception" always comes back to the judges. 

Full reference: Frison-Roche, M.-A., Compliance & Regulatory Soft Law, legal Certainty and Cooperation: example of the U.S. Financial Crimes Enforcement Network new Guidelines on AML/FT, Newsletter MAFR - Law, Compliance, Regulation, 2nd of September 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

The Financial Crimes Enforcement Network (FinCEN) is an organ, depending on the American Treasury, in charge of fighting against financial criminality and especially against money laundering and terrorism financing. For this, it has large control and sanction powers. 

In August 2020, the FinCEN published a document untitled "Statement on Enforcement" which aimed to explicit its control and sanction methods. It reveals what firms risk in case of offense (from the simple warning letter to criminal pursuits passing through financial fines) and the different criteria on which FinCEN is based to use one sanction rather than another. Among these criteria, we find for examples the nature and the seriousness of committed violations or the firm's history but also the implementation of compliance program or the quality and the spread of the cooperation with FinCEN durning the investigation. 

One of the objectives of the publication of such an information document is to obtain the cooperation of firms by creating a confidence relationship between the regulator and the regulated firm. However, it is very difficult to ask to the firms to cooperate and to furnish information if they can fear that this same information can be used later as proof against them by the FinCEN. 

Another objective is to reinforce legal security and transparency. However, the FinCEN's declaration does not seem to commit it, because it is not presented as a chart but as a simple declaration. Indeed, the list of the possible sanctions and the criteria used by the FinCEN are far from being exhaustive and can be completed in concreto by the FinCEN without any justification.

Full reference: Frison-Roche, M.-A., The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection, Newsletter MAFR - Law, Compliance, Regulation, 25th of August 2020 

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

The "right to be forgotten" is an invention of the Court of Justice of the European Union during the case Google Spain in 2014. It implies that digital firms block the access to personal data of someone who asks it. This "right to be forgotten", which permits to impose secret to third parties has largely been generalized by GDPR in 2016. This new fundamental subjective right is a very political and European right. United-States which, on the contrary of Europe, did not experience nazism, links the "right to be forgotten" to the protection of consumer, conception which especially leads California Consumer Privacy Act adopted in 2018 to link this right to a situation of absence of necessity of this data for the firm which obtained it. 

In Europe, this willingness to protect directly the person increases the scope of such a subjective right. Thus, in France and in Luxembourg, since 2020, a cancer survivor can thus ask that such an information is not accessible among his or her health data, especially for insurance companies which use them in their risk calculus to set premium amount. Netherlands will do the same in 2021 to fight against discrimination between banks' and insurances' clients. 

The "monumental goal" is therefore not so much here the protection of individual freedoms as the protection of the vulnerable person, which is bye the way the keystone of a Compliance Law, concealing sometimes prohibition to circulate information (as here) and sometimes obligation to circulate information (in other cases, where the alert must be given) depending on whether vulnerable people are protected either by one or by the other.

Full reference: Frison-Roche, M.-A., Being obliged by Law to unlock telephone is not equivalent to self-incrimination: Cour de cassation, Criminal Chamber, Dec. 19, 2019, Newsletter MAFR - Law, Compliance, Regulation, 21st of August 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

The Cour de Cassation (French Supreme Judicial Court) made a decision on 19th of December 2019 about a case concerning a refusal to communicate his mobile phone's unlock code to the police while the police found him with a significant quantity of narcotic and a lot of cash and that there was a certain probability that this mobile phone get proofs of culpability of its owner. The individual was indicted not for narcotic trafficking but for not having communicate its unlock code which constitute an offense to article 434-15-2 of code pénal, from the loi du 3 juin 2018 renforçant la lutte contre la criminalité organisée, et le terrorisme et leur financement (law reinforcing organized crime, terrorisme and their financing).

The accused invokes before the court its right to not incriminate oneself. Indeed, the configuration face to policemen was such that if he refused to communicate its unlock code, he will be punished because of this obligation to communicate his code and that if he accepted, he will also be sanctioned because of the proofs contained into the mobile phone. Such a configuration therefore offered him no alternative to confessing, which is contrary to the European Convention on Human Rights and to European and national jurisprudence.

Face to such a case, the Cour de Cassation chose to segment the information and proposed the following solution: if the researched information cannot be obtained regardless of the suspect willingness, it is not possible to constraint this person to communicate this information without violating its procedural rights, but if the information can be obtained regardless of the suspect willingness then the individual is obliged to communicate his code. In the current case, as it was possible for policemen to obtain information contained in the phone by technical means, longer but existent, then the refuse of communication of the unlock code by the suspect constitute an obstruction that should be sanctioned. 

Such a decision is an exemple of the conciliation by the judge of two fundamental but contradictory "monumental goals" of Compliance Law: transparency of information towards public authorities and very sensible personal data protection. 

​To go further, read Marie-Anne Frison-Roche's working paper: Rethinking the world from the notion of data

Full reference: Frison-Roche, M.-A., When Compliance Law is violated, does the "right to be (re)compensated"​ exist, and must it be encouraged or not? - The Marriott case, Newsletter MAFR - Law, Compliance, Regulation, 20th of August 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

In August 2020, Marriott International, online hotel room booking platform, has be sued before an English court by a consulting firm through a "class action" technic. The firm ask to Marriott International compensates the clients whose personal data jas been hacked while Marriott International which was in charge of this data, did not implement all it could to protect these data. According to the plaintiff firm, making the online platform responsible in Ex Ante of the clients' data security and constraint it to compensate injured clients in case of failure is a more important incentive for the firm to do its best to protect this data than a simple fine.    

Many similar actions are ongoing, especially during English Courts where the practice of "class action" is more developed. The question is therefore to know whether it is interesting to encourage the development of this kind of process in France. Concretly, a substantial subjective right (here the right to have its data protected) exists only if it is accompanied by a procedural right to size the judge in order to he or she activates it. The right to ask for a compensation in case of violation of these Compliance obligations but also is therefore not only a strong incentive for firms but also a condition of effectivity of these same obligations, knowing that the effectivity is the major care of Compliance Law.  

Full reference: Frison-Roche, M.-A., Why the decision of the French Constitutional Council of 7.08.2020 about authors of terrorist offences is so informative for Compliance & Criminal Law, Newsletter MAFR - Law, Compliance, Regulation, 13th of August 2020

Read, by freely subscribing, the other news in the Newsletter MAFR - Law, Compliance, Regulation 

Summary of the news

On 7th of August 2020, the Conseil Constitutionnel (French Constitutional Court) made a decision concerning the constitutionality of a French law implementing safety measures against authors of terrorist offenses after their sentence. The law permitting to impose, through an act from the administration, various controls or interdiction to communicate with some people for authors of terrorist offenses after the end of their sanction.  

Although the Conseil Constitutionnel estimated that such dispositions was disproportionate with regards to the objective, which prompted it to censor the text, it recognized that, since terrorism seriously disturbs public order through intimidation and terror, the fight against terrorism contributes to the objective of constitutional value consisting of preventing attacks on the public order. Thus it is not the nature but the intensity of the proposed measures which pushed the Conseil Constitutionnel to state this text not constitutional. By the way, the Conseil affirms that if the legislator submits it a law whose the measures are more proportionate to the goal, these, although Ex Ante and justified only by the existence of a risk, will be declared in conformity with the Constitution.

The Conseil Constitutionnel confirms here that the fight against terrorism financing is a "monumental goal" of Compliance Law. 

Full reference: Frison-Roche, M.-A., Against money laundering, what time matters? Does it work, between ExAnte and ExPost? (BIL case), Newsletter MAFR - Law, Compliance, Regulation, 11th of August 2020

Read, by freely subscribing, the other news in the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

The activity of money laundering is detrimental not only in itself but also because it permits the development and the sustainability of other criminal activities such as drug trafficking, weapon trafficking or human beings selling. Fighting against money laundering could permit to indirectly fight against these underlying activities, by the way very difficult to fight. Thus, the fight against money laundering has become a "monumental goal", which justifies the adoption of tools sometimes much more powerful than those used by classical criminal Law. For the sake of efficiency, the legal obligation to prevent money laundering is given to every body able to do it, as banks, real estate agents or gaming society, under the penalty of sanction. 

On 10th of August 2020, the Luxembourgish financial market supervisor convicts the International Bank of Luxembourg to pay a fine of 4,5 millions of euros because of weaknesses detected in its process of fight against money laundering. However, when the sanction has been pronounced, the bank had already remedied the weaknesses identified. It is important to observe that what is important for Compliance Law, it is not that a non compliant behavior is punished but rather that the crucial firm modifies its behavior in order to being more efficient in the realization of the "monumental goal", only concern of the public authority. Thus, an Ex Post sanction against the crucial operator is not an end in itself and can be justified only if it permits to incite the crucial operator to act or rather to desincite to do anything. Compliance Law is an Ex Ante legal system. 

To go further, read: 

• Frison-Roche, M.-A., Le couple Ex Ante - Ex Post, justificatif d'un droit spécifique et propre de la Régulation, 2006 (in French)

Full reference: Perben, D., Rapport relatif à la profession d'avocat (written in French), Report to the French Minister of Justice, July 2020, 42p.

Read the report