Abusive terms and personal data: Google sentenced in France

In the wake of the lengthy judgment by which it had ordered Twitter to amend almost all the clauses contained in its contractual documentation intended for French users – which we commented in an article entitled Unfair terms and personal data: Twitter sentenced by a French court – the Paris Court of First Instance ruled on February 12, 2019 on the validity of the clauses contained in Google’s General Terms of Use and Privacy Policy.

The combined reading of the thorough analysis made by the Court in this recent decision and in the previous decision concerning Twitter offers a valuable framework for identifying provisions that may be considered abusive or unlawful within the meaning of French consumer law and the legislation on the protection of personal data.

Based on French consumer law and the French Data Protection Act of January 6, 1978, the Paris Court of First Instance (the “Court”) ordered Google to amend nearly 38 clauses and to make the entire judgment accessible from its website and applications.

As a first step, the Court reaffirmed that the provisions of the Consumer Code and the Data Protection Act are applicable:

• The provisions of French and European consumer law are applicable to the contractual documentation intended for French consumers

The Court held that by collecting data entered free of charge by the user when accessing the platform and by marketing such data for a pecuniary interest, Google is acting for commercial purposes and derives a benefit therefrom within the meaning of Article 1107 §1 of the French Civil Code[1], so that it must be regarded as a professional within the meaning of the introductory article of the French Consumer Code[2].

The Court considered that the provisions relating to unfair terms provided for in Article L. 212-1 of the French Consumer Code are applicable insofar as they do not require that the contract be concluded for a pecuniary interest. It only took into account the respective quality of each of the parties, regardless of whether the services are provided to consumers and professionals.

Consequently, “it must be said that in the end all the disputed clauses relating to these two contractual regimes of Terms of Use and Privacy Policy, proposed and managed from dedicated digital platforms operated by Google in its capacity as a professional, are subject to all the provisions of French and European consumer law, in particular the provisions relating to unfair or unlawful terms and unfair practices, as the user who participates in these services remain a consumer with regard to all the provisions of the [French] Consumer Code”.

• The French Data Protection Act is applicable

The Court pointed out that the general purposes of the French Data Protection Act “perfectly coincide with those of consumer law, in particular with a view to punishing any significant imbalance between professionals and ordinary individuals in their various consumer activities”.

Considering in particular that Google collects from the French territory or from the territory of EU Member States – for economic exploitation purposes and by determining itself the purposes of the processing – personal data of users wishing to set up a dedicated account on this “Google+” platform by personal identity details and the application of various algorithms allowing geolocation and profiling applications, the Court stated that the French Data Protection Act was applicable.

In a second step, the Court thoroughly analyzed each of the clauses contained in Google’s General Terms and Conditions of Use and Privacy Policy.

In particular, it found that the following terms were unfair or unlawful:

• The lack of clarity of the general terms of use

In general, the Court reiterated once again that it is the professional’s duty to provide clear and complete information prior to the conclusion of any contract, i.e. in this case the use of Google’s services. The Court therefore invalidated the clauses by which Google deducts from the mere use of its services, the acceptance of all Google’s terms of use and privacy rules.

More specifically, the Court noted that Google’s contractual documentation refers to a “principle of universality” within Google with regard to the application of privacy rules, except where other Google services are governed by other rules. However, the Court considered that the information provided to the user is not legible and requires him/her to carry out a search in order to determine the rules applicable to the various services offered by Google that he/she uses.

Finally, the Court pointed out that the clause in the terms of use according to which “[Google] may suspend or stop providing our Services to you if you do not comply with our terms or policies or if we are investigating suspected misconduct” is unlawful in that it is too vague and does not provide for sufficient escalation process between the suspension measure and the final decision to exclude the user from the services.

• The terms concerning cookies

The Court considered that the terms concerning cookies included in the various versions of the Privacy Policy are unlawful.

Indeed, beyond the lawfulness of the practice tending towards the automatic and default use of cookies and the instructions for use provided to the user, it is necessary to determine the lawfulness of such clauses with regard to Article 32 II of the Data Protection Act and in particular to verify whether it makes it possible to “correctly apprehend (with the exception of linguistic impact) the content, seriousness and consequences of the dysfunctions incurred in the event of implementation of this personal configuration option” which aims at blocking all or part of the cookies. 

As such, with regard to the quality and continuity of service provided by Google, the Court stated that such a clause would reveal a “frustratory right” in that, while it allows the user a free exercise of the right to block the use of cookies, it dissuades him/her from implementing it by emphasizing the risks of malfunctions of the user’s personal equipment, the seriousness and foreseeable consequences of which are not specified. In this sense, the Court considered that such a clause reveals a significant imbalance between the parties to the detriment of the user.

• Clauses allowing Google to unilaterally modify user’s contents

The Court pointed out that Google’s Privacy Policy contains a clause stating that “We may use the name you provide for your Google Profile across all of the services we offer that require a Google Account. In addition, we may replace past names associated with your Google Account so that you are represented consistently across all our services.”

Although the Court noted the undeniable practical advantage of this unification of the user’s presentation by Google, it regretted that Google thus claimed the right to unilaterally modify or adapt contents containing personal data, thereby risking altering the data communicated by the user.

It finally recalled that the user’s consent was not sought in any way and declared that this clause was abusive. 

• The terms concerning the sharing of personal data

“Many of our services let you share information with others. Remember that when you share information publicly, it may be indexable by search engines, including Google. Our services provide you with different options on sharing and removing your content».

Under this clause, personal data shared by the user may be indexed by search engines, unless the user sets his profile differently in order to exclude such indexing. 

Recalling the scope of the Costeja judgment[3] delivered by the Court of Justice of the European Union and enshrining the right to be forgotten online offered to users, the Court pointed out that, in the case at hand, indexation was automatic by default and without specific indication of the possibility for the user to disable that automaticity.

Consequently, the Court considered that such a clause was deemed unwritten (i.e. ineffective) because of its unlawful or abusive nature.

• The unlawfulness of clauses relating to copyright disputes

The Court noted that copyright disputes initiated by a user and in which Google should be party are considered only from the exclusive angle of the American law known as the “Digital Millenium Copyright Act”.

The Court pointed out that, without even questioning the more protective nature of such a law in comparison with French law, American law is clearly less accessible than French law.

However, this indirect exclusion from the provisions set forth in French intellectual property laws or in the Law for the confidence in the digital economy constitutes a significant imbalance to the detriment of the French user and demonstrates Google’s intention to act only within the framework of US law. 

• The unlawfulness of the clause granting a worldwide license to Google

The Court observed that the use of the services was “subject by inference” to the granting to Google of an operating license on all the contents provided by the user, and more particularly a worldwide, non-exclusive and free license, the purpose of which is not limited in time or space.

It recalled the terms of Article L. 131-1 of the French Intellectual Property Code, according to which “the global assignment of future works is null and void”, and Articles L. 131-2 and L. 131-3 of the same Code, according to which contracts transmitting copyrights must be recorded in writing since the assignment is subject to the mention of each of the rights in the deed of assignment, in particular as regards the scope and destination of the field of exploitation of such rights.

In addition, according to the French Consumer Code, professionals must provide consumers with contracts drafted in a clear and comprehensible manner.

In the present case, however, it must be noted that while the content transmitted by the user may be protected by copyright, the clause grants Google a free right of use over such content without specifying the content, the nature of the rights granted nor the authorized uses.

Consequently, such clauses are deemed unwritten because of their unlawful or abusive nature.

***

While on the day of the judgment some of the terms deemed unlawful had already been modified by Google, in particular because of the institution of proceedings more than 5 years ago, the careful analysis of the Court contained in the “Twitter” decision and in this decision offers professionals a valuable framework for identifying provisions that could be considered unfair or unlawful. 

In the coming months, the Court is expected to issue a new judgment on Facebook in an action brought by the French association UFC Que Choisir. A case to be followed up…

[1] “A contract is for pecuniary interest where each of the parties receives a benefit from the other in return for what he/she/it provides”.

[2] “For the purpose of this Code, the following terms shall have the meaning assigned to them hereunder […] professional: any natural or legal person, public or private, who acts for the purposes falling within the scope of his/her/it commercial, industrial, craft, liberal or agricultural activity, including when acting in the name or on behalf of another professional”. 

[3] Google Spain SL and Google Inc. vs. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, CJEU, Grand Chamber, May 13, 2014, C-131/12.