French Consumer Protection Panel Flags Unfair Privacy Practices

France created an advisory panel to issue guidance on what constitutes an unfair clause in various circumstances.  On December 3, 2014, the panel published a lengthy opinion identifying 46 clauses in social media terms of use and privacy policies that the panel considers unfair.

The panel criticizes the widespread use of cross-references.  In their view, when terms of use refer to other policies (e.g. privacy policies, acceptable use policies) consumers cannot have a clear understanding of the contract.  The panel points out that provisions drafted in English are unfair under French consumer protection law because French consumers cannot be presumed to understand English.

The panel indicates that it is misleading for social media platforms to tell consumers that the service is free.  The contract should explain that the service is provided in exchange for the platform’s ability to use the consumer’s personal data to sell advertising.  Privacy policies that state that IP addresses and browsing habits are not personal data are also unfair and misleading, according to the panel, because they diverge from the French legal definition of personal data.  Many privacy policies do not define specific purposes for which personal data may be used.   Because French data protection law requires that individuals are informed of the specific purposes for use, clauses of this kind are unfair, says the panel.  The same applies to provisions that purport to authorize the platform to process sensitive data.  Any processing of sensitive data requires a separate explicit consent from the individual.  The panel identified provisions on onward transfers as another problem:  Most privacy policies do not identify the third parties to whom personal data may be transferred and do not identify the purposes for which the third parties may use the data.  Likewise, privacy policies often do not offer the individual a right to object to transfers of their data.  These provisions are unfair, according to the panel.

Any provisions that do not impose a strict duration on the platform’s retention of personal data are unfair because they violate the principles of French data protection law.  The same holds true for clauses that provide for the transfer of personal data outside the EU but don’t give the individual the possibility to provide a specific consent to the transfer.  According to the panel, certain privacy policies shift the burden for keeping personal data secure to the individual.  The panel states that the burden for protecting personal data lies principally with the platform, and that it is unfair to transfer this burden to the individual.

Any provisions that purport to allow the service provider to unilaterally modify its privacy policy without notifying the consumer in advance and giving the consumer an opportunity to terminate the service is also unfair under French consumer protection law.  The same holds true for clauses that require the consumer to regularly check the terms of use and privacy policy to make sure there are no changes.  According to the panel, the platform is responsible for informing the consumer of any changes.  Severability clauses are unfair, says the panel, because they do not take into account the situation in which an invalid clause is critical to the entire agreement.  Finally, choice of law provisions that purport to exclude the application of French consumer protection legislation are unfair.

The panel’s opinion is not binding on courts or on the French consumer protection agency.  However, the opinion has considerable persuasive authority, creating a presumption that the clauses identified in the opinion are unfair under French consumer protection law.  The panel’s opinion shows that consumer protection authorities may become more involved in the enforcement of data protection laws, thus complementing the enforcement actions of the French data protection authority, the CNIL.

Authored by Winston Maxwell