Compliance & Regulatory

Having received several complaints against the Carrefour group, the French Data Protection Authority carried out inspections between May and July 2019 at Carrefour France (mass retail sector) and Carrefour Banque (banking sector).

During these inspections, it found a number of breaches in the processing of customer and potential user data, and consequently imposed a 2,250,000 euros fine on Carrefour France and a 800,000 euros fine on Carrefour Banque. The breaches mainly concerned the information provided to individuals and the respect for the rights of such individuals.

The Commission Nationale de l’Informatique et des Libertés (French Data Protection authority or “CNIL”) has just imposed a penalty of 250,000 euros on Spartoo, a company specializing in the online sale of shoes. The CNIL noted several breaches of the GDPR, the general regulation on data protection which came into force on May 25, 2018.

This is the first penalty imposed by the CNIL as “lead supervisory authority” in cooperation with other EU supervisory authorities as the consumers (and their personal data) of Spartoo which is based in Grenoble extend beyond French borders.

On June 2, 2020, the French Minister of Justice sent to all competent public prosecutors a circular for immediate application specifying France’s “criminal justice policy in the fight against international corruption”.

This circular sets out guidelines for legal action at all stages of criminal proceedings, from the information gathering stage to the determination of the mode of prosecution.

On April 24, 2020, the Versailles Court of Appeals handed down an insightful decision concerning the implementation of employee protection measures by employers in the current health context and lockdown imposed by the Government on March 16.

Ruling on an appeal lodged by the American giant Amazon against the order issued by the Nanterre Judicial Court on April 14, 2020, the Versailles Court of Appeals upheld the order in that it provided for a mandatory obligation to implement a comprehensive national health and safety prevention plan for employees, with prior consultation with staff representatives. This decision is in line with the need to reconcile the necessity to maintain a business activity with the preservation of employees’ health.

The French Data Protection Authority has served a formal notice on EDF and Engie for non-compliance with some of the requirements for obtaining consent in relation to the collection of consumption data from Linky smart meters, as well as for an excessive retention period of such consumption data.

Both companies have three months to comply.

The French Anti-Corruption Agency, created by Law No. 2016-1691 of December 9, 2016 on transparency, fight against corruption and modernization of the economy, commonly referred to as the “Sapin II Law”, has recently supplemented its recommendations by issuing a best practice guide for M&A transactions.