On 12 January 2012, the CNIL imposed a significant fine on a real property reports company which had purchased a list of real estate owners' personal data, obtained from online advertisements posted
On 12 January 2012, the CNIL imposed a significant fine on a real property reports company which had purchased a list of real estate owners' personal data, obtained from online advertisements posted by these real estate owners, and which then sent direct marketing communications by SMS to the property owners without having previously obtained their express consent.
The CNIL's decision is important for three reasons:
Although the CNIL's concern about the issue of obtaining prior consent before sending marketing communications dates from 2009, until now it has only imposed fines on marketing list brokers and always on the grounds of the French Data Protection Act of 6 January 1978, in particular Article 6 on fair collection (Decision no. 2009-148 of 26 February 2009 "Directannonces" [fine of 40.000€] and Decision no. 2011-193 of 28 June 2011 "PM Participation" [fine 10.000€]).
How should this "ensure" (in French "veiller à") be interpreted? Unfortunately the CNIL does not provide further details. In the case at hand, the contract made with the marketing list broker did not state that the marketing list broker had obtained prior consent from the persons in question to receive direct marketing communications by SMS. Would the company have avoided a fine if such a clause had been included? We cannot be sure. However, this does seem to be the most practical and reasonable solution.
Following this decision, two questions remain unanswered:
It will be worth paying attention to the future decisions rendered by the CNIL in this area.
And finally, it is important to note that this contractual clause will not exempt the client from compliance with the French Data Protection Act and in particular, the obligations to give notification of processing, inform those whose data is processed, and implement an effective system for opposition to processing.
The CNIL's decision is important for three reasons:
- Firstly, the amount of the fine imposed is relatively high (20,000 €) and the CNIL made its decision public. It is obvious that the CNIL wishes to set an example in order to put an end to this type of practice, which according to it "inundates owners of property for sale and distorts competition".
- Secondly, it is the first time a fine has been imposed on the grounds of the direct marketing provisions which result from the Electronic Commerce Directive and which are included in Article 34-5 of the Post and Telecommunications Code.
Although the CNIL's concern about the issue of obtaining prior consent before sending marketing communications dates from 2009, until now it has only imposed fines on marketing list brokers and always on the grounds of the French Data Protection Act of 6 January 1978, in particular Article 6 on fair collection (Decision no. 2009-148 of 26 February 2009 "Directannonces" [fine of 40.000€] and Decision no. 2011-193 of 28 June 2011 "PM Participation" [fine 10.000€]).
- And thirdly, because the CNIL clearly states that marketing list brokers' clients have an obligation to "ensure that they buy only "opt-in" files from their partners, ie, containing the addresses of persons who have given prior consent to receive marketing communications".
How should this "ensure" (in French "veiller à") be interpreted? Unfortunately the CNIL does not provide further details. In the case at hand, the contract made with the marketing list broker did not state that the marketing list broker had obtained prior consent from the persons in question to receive direct marketing communications by SMS. Would the company have avoided a fine if such a clause had been included? We cannot be sure. However, this does seem to be the most practical and reasonable solution.
Following this decision, two questions remain unanswered:
- Is a contractual clause stating that the persons in question gave their consent to receive direct marketing communications sufficient to protect the purchaser of such list from being fined?
- Insofar as the CNIL has only given its opinion on data collected from real estate advertisements, will its position be the same for other types of data collection and intended recipients?
It will be worth paying attention to the future decisions rendered by the CNIL in this area.
And finally, it is important to note that this contractual clause will not exempt the client from compliance with the French Data Protection Act and in particular, the obligations to give notification of processing, inform those whose data is processed, and implement an effective system for opposition to processing.