France (FR)

France

Projet de Loi n°89 - pour la confiance dans l' économie numérique
First Reading in the National Assembly 2003-02-26
 
This Bill implements Directive 2002/58/EC. The 'anti-spam' provisions are contained in Article 12 by which Article L.33-4-1 of the Code of Posts and Telecommunications is amended:

« Est interdite la prospeciton directe, notamment la publicité, au moyen de courriers électroniques utilisant, sous quelque forme que ce soit, les cordonnées d'une personne physique ou morale non inscrite au registre du commerce et des sociétés qui n'a pas exprimé son consentement préalable à recevoir de tels courriers électroniques.»

Which is to say that sending advertising by email to natural persons who have not registered their prior consent is prohibited.

Since the publication of the original Report "Electronic Mailing and Data Protection" in 1999 the Commission has continued to be active. In July 2002 they started collecting evidence via a "spam box", and have proceeded to take legal action against senders of Unsolicited Bulk Email. Information concerning this and recommendations for users on dealing with spam can be found on CNIL's website.

The National Data Processing and Liberties Commission (Commission Nationale de l'Informatique et des Libertés [CNIL]) published a report on Electronic Mailing and Data Protection. The full text is available in PDF in English and in French. This is one of CNIL's initiatives for an information society which respects the rights of netizens. A press release was issued when the report was first published.

from the report

Back to principles : the Data Protection Directive of October 24, 1995 [95/46]

Purpose principle : keeping to the purpose of newsgroups and mailing lists

An individual who uses electronic mail to express himself in a defined newsgroup and on a precise subject, or who enters himself on a mailing list to share information with a group of interlocutors interested by a common subject, has not, by definition, agreed to receive direct marketing messages of any nature. From that perspective, the purpose principle laid down in article 6 enables us to protect the original purpose of newsgroups as places of free expression and communication, and of mailing lists as structures for exchanges on a subject of shared interest.

Legitimacy of the processing: no electronic mailing without consent

Unless one considers the automated collection for commercial direct marketing purposes of all of the e-mail addresses appearing in Internet public spaces as a legitimate interest that prevails over the legitimate interest of the net surfers (the double condition established by article 7f of directive 95/46), the general directive makes such processing subject to the "unambiguous consent" of the data subject (article 7 a).

Prior information: no collection without the persons' knowledge

Pursuant to articles 10 and 11 of directive 95/46, the data collector's obligation of information must be fulfilled at the time of collection of the data or -if a disclosure to a third party is considered- no later than the time when the data are first disclosed. This system seems to prevent an organisation which has collected e-mail addresses in Internet public spaces from using it for its own purposes, if it did not previously inform the persons, and from disclosing it to third parties if it did not previously inform the concerned net surfers of their right to object. Therefore, if the proposed e-commerce directive were to impose an obligation of information on the organisation responsible for the marketing operation (not always that which collects the data) when sending an unsolicited first message, this would conflict with the rules contained in directive 95/46.

Right to object: possibility to object to the collection of one's e-mail address for direct marketing purposes

Article 14 of directive 95/46 recognises for every person the right to object to the commercial use of her/his personal information and to disclosure of data to third parties. The "opt-out" system, which legitimises third parties' collection and use of e-mail addresses for direct marketing purposes without the data subject, or the manager of the site in which said e-mail addresses were collected, being previously informed of such a collection, or being able to object to such a use, would fail to provide the protection required by directive 95/46.

To date, there are no specific laws or court verdicts. Nevertheless, there is some movement to be seen at the political and legal levels:-

1. AT THE POLITICAL LEVEL
    
• the French marketers Fédération des Entreprises de Vente A Distance (FEVAD) promote opt-out. Take a look at their site, particularly their presentation of the "Robinson List".
   
• The Data Protection Commission Commission Nationale de l'Informatique et des Libertés (CNIL) has good relationships with the FEVAD for decades, and for that reason does not seem to know what would be the best choice between opt-in and opt-out.
   
• the French government will wait for the CNIL...

Conclusion : France may promote opt-out.

2. AT THE LEGAL LEVEL
    
• What is clear : if a subscriber damages your servers or damages your company in any way by his/her spamming (and if you can prove your prejudice of course), you can sue him. The question of the whether the damages are done on purpose or not is not relevant (see The Law).
   
• What is unclear:
   
1. can an ISP end a contract if the subscriber spams without concrete prejudice for the ISP (except the fact that the ISP receives complaints from Internet users)?

Probably yes, if the General Terms ask the subscriber to respect the principles of the Netiquette, which includes that the subscriber should not spam. We are waiting for a court decision, which would answer that question.

2. Can an ISP block unsolicited mails?

Probably not, because they are private correspondence. Nevertheless, some French ISPs block massive sendings.

3. THE FRENCH LAW:

No specific texts, but some are relevant:

1. Damages done on purpose:

Article 323-2 code pénal

Le fait d'entraver ou de fausser le fonctionnement d'un système de traitement automatisé de données est puni de trois ans d'emprisonnement et de 300 000 F d'amende.
 

2. Damages involuntarily done:

Article 1382 code civil

Tout fait quelconque de l'homme, qui cause à autrui un dommage, oblige elui par la faute duquel il est arrivé, à le réparer.

Article 1383 code civil

Chacun est responsable du dommage qu'il a causé non seulement par son fait, mais encore par sa négligence ou par son imprudence.
 

3. Data Protection (in this case, you would sue the spammer who uses a database without agreement of the people who receive the spam):

Code Pénal : Section 5 : Des atteintes aux droits de la personne résultant des fichiers ou des traitements informatiques

Article 226-16 code pénal (Loi n° 92-1336 du 16 décembre 1992 art. 360 et 373 Journal Officiel du 23 décembre 1992 en vigueur le 1er mars 1994)

Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements automatisés d'informations nominatives sans qu'aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de trois ans d'emprisonnement et de 300 000 F d'amende.

Article 226-17 code pénal

Le fait de procéder ou de faire procéder à un traitement automatisé d'informations nominatives sans prendre toutes les précautions utiles pour préserver la sécurité de ces informations et notamment empêcher qu'elles ne soient déformées, endommagées ou communiquées à des tiers non autorisés est puni de cinq ans d'emprisonnement et de 2 000 000 F d'amende.

Article 226-18 code pénal (Loi n° 94-548 du 1 juillet 1994 art. 4 Journal Officiel du 2 juillet 1994)

Le fait de collecter des données par un moyen frauduleux, déloyal ou illicite, ou de procéder à un traitement d'informations nominatives concernant une personne physique malgré l'opposition de cette personne, lorsque cette opposition est fondée sur des raisons légitimes, est puni de cinq ans d'emprisonnement et de 2 000 000 F d'amende.