Food for thoughts

► Référence complète : Cl. Jourdain-Fortier, "La globalisation", in J.-B. Racine (dir.), Le droit économique au XXIe siècle. Notions et enjeux, LGDJ, coll. "Droit & Économie", 2020, pp. 365-393

____

📕consulter une présentation générale de l'ouvrage, Le droit économique au XXIe siècle. Notions et enjeux, dans lequel cet article est publié 

____

► Résumé de l'article : 

____

🦉Cet article est accessible en texte intégral pour les personnes inscrites aux enseignements de la Professeure Marie-Anne Frison-Roche

________

🌐follow Marie-Anne Frison-Roche on LinkedIn

🌐subscribe to the Newsletter MAFR Regulation, Compliance, Law

____

► Full Reference: M.-A. Frison-Roche, "La compliance" ("Compliance"), in J.-B. Racine (ed.), Le droit économique au XXIe siècle. Notions et enjeux, LGDJ, "Droit & Économie" Serie, 2020, pp. 97-108

____

📝read the article (in French)

____

🚧read the bilingual Working Paper which is the basis of this article, with additional developments, technical references and hyperlinks

____

📕read a general presentation of the book, Le droit économique au XXIe siècle. Notions et enjeux, in which this article is published

____

📚see the presentation of the other books published in this Serie, founded and directed by Marie-Anne Frison-Roche

► English Summary of the article: 

________

Full reference: Vergnolle, S., L'effectivité de la protection des personnes par le droit des données à caractère personnel (The effectiveness of the protection of people by personal data Law (our translation)), Passa, J. (dir.), thesis, Law, Panthéon-Assas University (Paris II), 2020, 531 p.

Read the thesis (in French)

Read directly and only the table of contents (in French)

To go further about regulation of personal data, read: 

• Frison-Roche, M.-A., Rethinking the world from the notion of data, 2016
• Frison-Roche, M.-A., The regulatory conséquences of a world redesigned from the concept of data, 2016. 

Full Reference : Frison-Roche, M.-A., Rights, primary and natural Compliance Tools, Working Paper, July  2020.

This Working paper is the basis for an article published in the collective book  Compliance Tools .

____

There was a time when Regulatory techniques  were above all only calculations of the best tarifications, taken up by monopolistic companies, while Compliance techniques were only obedience to all rules governing us. All this could therefore only be business of abacus and badine, used by engineers and consisted only of mechanical reflexes of "conformity" to all kinds of rules with the corset ensuring that everyone is bent in front of them!footnote-1946. In the perspective of a Regulation and Compliance thus conceived, that is to say effective, it would not be necessary to insert prerogatives for people, since these could only be sources of inefficiency, of cost. and protest, where the order would come from figures set in advance and controlled processes.

Systems have since evolved to integrate these prerogatives of each person: rights. Is this evolution really acquired? Maybe more effectively in Regulation Law than in its extension which is Compliance Law. This may be surprising since Compliance Law, in that it extends Regulatory Law in enterprises should, on the contrary, promote rights by meeting the enterprise, which is a group of people ....!footnote-1986 . But the modern reluctance to define the enterprise (and the company) as a group of people and the preference given to a definition of the company (and the enterprise) as an "asset", a "good" of which investors would be the owners, maybe explains the sidelining of rights not only in Regulatory Law but also in Compliance Law even though it is being deployed in the space of the enterprise!footnote-1987.

In addition, if Regulation has long been the subject of a branch of Law in which rights have full place, the presentation of Compliance as "conformity", that is to say the proven assurance of obedience to all the applicable rules, leaves no space for the prerogatives of people, which appear rather as resistance to the obedience that would be expected of them. There again, the expectation of what would be a good ratio of conformity between behaviors and prescriptions would be obtained by a "design", data processing being the new form of calculation, improved by precision tools where the being human is not required!footnote-1989. His fallibility and the little confidence which one can place in him leads even to exclude the people and to conceive Compliance system between machines, not only to alert of the failures, but also to manufacture the "regulations" and to connect those. here, in a "regulatory fabric" without a jump stitch, entirely enveloping human beings!footnote-1990.

It would therefore be with regret, and probably because some constitutional jurisdictions still attach some value to fundamental rights that the systems of "conformity" of behavior to the rules make some room for the prerogatives of people, their more essential rights. It is sometimes said that this is part of the cost. It would therefore be as by "forcing" that rights would exist in Compliance systems, a kind of price that the effectiveness of Compliance must pay as a tribute to the Rule of Law principle!footnote-1991.

If in a poor definition Compliance is conceived in this only "conformity", leading to a landscape in which the behaviors of the people adjust to the rules governing the situations, Compliance being only the most "effective way" to ensure the application of the rules, in a mechanical perspective of Law, then it would effectively be necessary to reduce the prerogatives of people to a minimal part, because any "additional cost" is intended to disappear, even if it is produced here by constitutional requirements. In the looming battle between the effectiveness of the application of rules and the concern for the legal prerogatives of people who should above all obey and not claim their rights, especially their right not to obey , or their right to keep secret in Compliance techniques which is based on the centralization of information, the effectiveness of efficiency could only, by the very power of this tautology, prevail!footnote-1988... 

The defeat would not be total, however, collaboration would still be possible and active between people availing themselves of their rights and Compliance Law. Indeed, in many respects, if rights have been recognized in Compliance systems, it is not only because Compliance Law, like any branch of Law, can only be deployed with respect for fundamental rights. kept by fundamental legal texts, but also because of the effectiveness of rights as " Compliance Tools".

Indeed, because they constitute a very effective "tool" to ensure the entire functioning of a system whose goals are so difficult to achieve, because every effort must be made to achieve these goals, the public authorities not only rely on the power of crucial operators, but also distribute prerogatives to people who, thus encouraged, activate the Compliance system and participate in the achievement of the "monumental goals". Rights can prove to be the most effective tools to effectively achieve the goals set, to such an extent that they can be considered as "primary tools"  (I).

But it is necessary to be more ambitious, even to reverse the perspective. Indeed because all the Monumental Goals by which Compliance Law is defined can be reduced to the protection of people, that is to say to the effectiveness of their prerogatives, by a mirror effect between rights. given by Law to persons and the rights which constitute the very purpose of all Compliance Law, in particular the protection of all human beings, even if they are in a situation of great weakness, rights become a "natural tool" of Compliance Law (II).

Rights are the Compliance Law future. 

Full reference: Racine, J.-B. (ed.), Le droit économique au XXIe siècle. Notions et enjeux, Coll. Droit & Economie, LGDJ-Lextenso, 2020, 726 p.

____

Summary of the book : Economic Law has not been so important than today, at a time of phenomenal changes in our societies. Economics are everywhere and Law is directly requested, to accompany, frame and finalize economics. Economic Law, which remain without definition, must be perceived now as a fundamental understanding tool of the realities of our time. This book proposes both to take stock of what Economic Law is at the start of the XXIst century and to give prospective analysis of what it could be in the years to come. It has been designed as a collective research based on  30 key-words (like the firm, the market, globalization, artificial intelligence). Each author has taken a notion by placing it in a logic of Economic Law. It is therefore on a transversal and thematic analysis that the book is based.

Economic Law is an open house. While it seeks diverse schools of thought, it gives pride of place to diversity. The book has been realized in this spirit. If it gather many authors from Nice's school, it is also open to other perspectives and opinions. Economic Law, through its research topics and analysis methods is in constant change. This research shows that economics is a topic which crosses every legal branches, beyond business Law. 

The book is aimed at students wishing to familiarize themselves with Economic Law process, researchers intending to explore Economic Law themes in depth, and also practitioners who are looking for keys to understanding the current issues raised by the relationship between Law and Economics. 

List of authors:

• Jean-Baptiste Racine
• Éric Balate
• Jennifer Bardy
• Jean-Sylvestre Bergé
• Walid Chaiehloudj
• Jacques Chevallier
• Bruno Deffains
• Catherine Del Cont
• Pascale Deumier
• Isabelle Doussan
• Aude-Solveig Epstein
• Marie-Anne Frison-Roche
• Giulio Cesare Giorgini
• Lemy Godefroy
• Marie-Angèle Hermitte
• Clotilde Jourdain-Fortier
• Gilles J. Martin
• Frédéric Marty
• Séverine Menétrey
• Mehdi Mezaguer
• Eva Mouial Bassilana
• Irina Parachkévova-Racine
• Thomas Perroud
• Valérie Pironon
• Patrice Reis
• Fabrice Riem
• Jean-Christophe Roda
• Mahmoud Mohamed Salah
• Fabrice Siiriainen
• Katja Sontag
• Marina Teller
• Anne Trescases

Read the table of contents (in French)

Read Jean-Baptiste Racine's introductive article (in French)

Read Marie-Anne Frison-Roche's article (in French) and read the bilingual working paper on which this article is based. 

Full reference: Frison-Roche, M.-A., New SEC Report to Congress about Whistleblower Program: what is common between American and European conception, Newsletter MAFR - Law, Compliance, Regulation, 1st of December 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

Like every year since the adoption of the Dodd-Frank Act, the Securities and Exchanges Commission (SEC) and especially its Office of the Whistleblowers (OWB) handed to the Congress of the United-States a report about the success of its program concerning whistleblowers, especially estimated with the amount of financial rewards granted to them during the year. This report especially presents the amount granted to whistleblowers, the quality of the collected information and the efficacy of SEC's whistleblowers' protection process.

If Americans condition the effectiveness of whistleblowing to the remuneration of whistleblowers, Europeans oppose the "ethical whistleblower" who shares information for the love of Law to the "bounty hunter" uniquely motivated by financial reward and favor the former to the later, as it is proven in the French Law Sapin II of 2016 (which do not propose financial reward to whistleblowers) or the British Public Interest Disclosure of 1998 (which just propose a financial compensation of the whistleblower's losses linked to whistleblowing). 

However, American and European conceptions are not so far from each other. As United-States, Europe has a real care for legal effectivity, even if, because of their different legal traditions, Americans favor effectivity of rights while European favor effectivity of Law. If it places effectivity at the center of its preoccupations, Europe should conceive with less aversion the possibility to financially incite whistleblowers. Moreover, United-States and Europe share the same common willingness to protect whistleblowers and if rewarding would enable a better protection, then Europe should not reject it, as shows the recent declarations of the French Defenders of Rights. It is not excluded that both systems converges in a close future. 

Full reference: Lagarde, P., Preface of Le tournant global en droit international privé, Muir-Watt, H., Biziková, L., Brandão de Oliveira, A., Fernández Arroyo, D. P., Ma, M. (ed.), Editions Pedone, 2020, pp. 9-14

Read Paul Lagarde's preface (in French)

Full reference: Frison-Roche, M.-A., Facebook: Quand le Droit de la Compliance démontre sa capacité à protéger les personnes (Facebook: When Compliance Law proves its ability to protect people), interview with Olivia Dufour, Actu-juridiques Lextenso, 23rd of November 2020

Read the interview (in French)

Read the news of the Newsletter MAFR - Law, Compliance, Regulation about this question

La géographie est un élément qui demeure d'une grande pertinence dans la mise en place et la mise en œuvre des différentes régulations, ne serait-ce que parce que l'Histoire ne se pense pas sans la géographie, et que l'État ne se pense pas ni sans l'Histoire ni sans la Géographie, puisque dans un rapport consubstantiel avec le territoire et donc la clôture. Le Droit International Public repose sur cela, pour que les Etats, sujets de Droit international agissent dans un second temps dans l'espace international et notamment s'engagent les uns par rapport aux autres (traités internationaux).

Pourtant, confronter la Régulation et la Géographie conduit dans un premier temps à une aporie. En effet, à première vue, la Régulation, parce qu'expression de l'État, ne pourrait être que légitime sur un territoire national et, si on le décline juridiquement, qu'inséré dans le système juridique français. Or, le système juridique français étant construit d'une façon très particulière, sur la summa divisio du Droit public et du Droit privé, cela conduit certains à croire que le Droit de la Régulation serait une sorte de sous-branche du Droit public, puis à concentrer à titre principal l'attention sur la question des Autorités administratives indépendantes (AAI), puisque cela est familier au Droit public, tandis que les économistes bâtissent les règles qui gouvernent à travers le monde la Régulation sur un modèle qui serait totalement uniforme quelque soit l'endroit où il s'applique. Ce décalage conduit à ce qui peut apparaître à certains comme une sorte d"invasion" des catégories anglo-saxonnes, ne serait-ce que par le vocabulaire utilisé, lequel transporte avec lui les concepts du droit anglo-américain et ses méthodes.  Il est vrai qu'en matière de régulation, les États-Unis, dont le droit a ses racines dans le droit britannique, a tendance (parce qu'ils en ont la puissance de faire) a appliquer leur droit d'une façon de fait extraterritoriale, par le vocabulaire et les concepts. On mesure ainsi que la puissance de droit dépend souvent de la puissance de fait. A cela, s'ajoute le relais de l'autorité, celle de la Cour suprême des États-Unis, par exemple, ou de la Cour de Justice de l'Union européenne. L'on finit par se dire que tout est, en matière de régulation, affaire de "coutume", c'est-à-dire de façon où les choses se font là où elles se font (conception allemande classique). 

Dans cette grande dispute des territoires, l'on ne peut échapper à ces sorties, non seulement en raison des jeux de pouvoirs, mais parce que la Régulation est un appareillage technique sorti des objets, lesquels ne tiennent pas dans les frontières, la frontière étant une notion juridique affaiblie par le Droit économique, voire ennemie de celle-ci. Le rapport entre la Régulation et la Géographie va dès lors changer selon les secteurs, ce rapport demeurant étroit si l'objet technique régulé est corporel et immobile, le rapport se brisant si l'objet est immatériel. Mais la financiarisation de l'économie remet en cause cette gradation puisqu'elle dématérialise la corporéité de l'économie.

Plus encore, la question est de savoir si la Régulation doit prendre acte ou doit contrer l'habileté des opérateurs qui peuvent se soustraire au territoire, par le seul fait de bouger ou, par exemple, en créant des personnes morales ou bien en n'en créant pas (par l'action économique extérieure via de simples succursales non responsables). Si l'on estime que la Régulation est une théorie libérale qui pallie les défaillances techniques de marché, le Droit laisse cette habileté se déployer, voire on l'encourage. Si le Droit de la Régulation défend d'autres objectifs, cette habileté sera contrée. Des cas illustrent ces habiletés qui se confrontent, celles des opérateurs, des politiques et des régulateurs : le cas Péchiney- Triangle ou le cas BNPP, par exemple. 

Se reporter au plan de la leçon 5

Consulter les slides de la leçon 5

Accéder au plan général du cours.

Consulter la bibliographie générale du cours

Consulter le Glossaire du Droit de la Régulation et de la Compliance

Consulter la Newsletter MAFR - Law, Compliance, Regulation

Consulter ci-dessous la bibliographie spécifique à la Géographie & la Régulation: 

Full reference: CJEU, 1st chamber, 18th of November 2020, decision C‑519/19, Ryanair DAC vs DelayFix

Read the decision

Summary of the decision

This decision of the CJEU of 18th of November 2020 is about the jurisdiction clause for any dispute in air transport contracts, here those of Ryanair. This decision is especially interesting about the question to know whether the professional assignee (collection company) of a debt whose holder was a consumer may or may not avail itself of the consumer protection provisions, canceling the scope of this type of clause. 

The Court takes back the criteria and the solution already used in 2019 about a credit contract: the protection applies by the criterion of the parties to the contract and not of the parties to the disputes. Such a clause is effective only if the integrality of the contract is transferred to the professional, and not only some of the stipulations.

This Regulatory decision, through "private enforcement", incentivizes consumers to transfer their compensation claim (around 250 euros) to collection companies which, in turn, discipline airlines to stay on schedule.

Full reference: US Securities and Exchanges Commission, Whistleblower Program. 2020 Annual Report to Congress, 16th of November 2020

Read the report

Read, to go further on the question of whistleblowers:

• Frison-Roche, M.-A., The impossible unicity of the legal category of whistleblowers, working paper, 2019

Full reference: Kessedjian, C., Le tiers impartial et indépendant en droit international. Juge, arbitre, médiateur, conciliateur, Académie de Droit international de La Haye, 2020, 769p.

Read the forth of cover (in French)

Read the table of content (in French)

This working paper served as a basis for an interview organized by Olivia Dufour in French in Actu-juridiques-Lextenso on 11st of January 2021. 

Full reference: Frison-Roche, M.-A., "Health Data Hub est un coup de maître du Conseil d'Etat", interview realized by Olivia Dufour for Actu-juridiques, Lextenso, 22nd of October 2020

Read the news of 19th of October 2020 of the Newsletter MAFR - Law, Compliance, Regulation on which relies this interview: Conditions for the legality of a platform managed by an American company hosting European health data​: French Conseil d'Etat decision 

To go further, on the question of Compliance Law concerning Health Data Protection, read the news of 25th of August 2020: The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection 

Full reference: Coeurquetin, R., Comparaison mécanique des versions 2017 et 2020 des recommendations de l'Agence Française Anti-corruption sur la cartographie des risques de corruption, October 2020, 9 p. 

Read the mechanical comparison (in French)

To go further on the question of risk mapping, read Marie-Anne Frison-Roche's working papers: Drawing up Risk Maps a an Obligation and the Paradoxe of "Compliance Risks" and Anchor Points of the Risk Mapping in the Legal System

Full reference: Frison-Roche, M.-A., Conditions for the legality of a platform managed by an American company hosting European health data​: French Conseil d'Etat decision, Newsletter MAFR - Law, Compliance, Regulation, 19th of October 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

___

News Summary: In its ordinance of 13th of October 2020, Conseil national du logiciel libre (called Health Data Hub), the Conseil d'Etat (French Administrative Supreme Court) has determined the legal rules governing the possibility to give the management of sensitive data on a platform to a non-europeans firm, through the specific case of the decree and of the contract by which the management of the platform centralizing health data to fight against Covid-19 has been given to the Irish subsidiary of an American firm, Microsoft. 

The Conseil d'Etat used firstly CJEU case law, especially the decision of 16th of July 2020, called Schrems 2, in the light of which it was interpreted and French Law and the contract linking GIP and

The Conseil d'Etat concluded that it was not possible to transfer this data to United-Sates, that the contract could be only interpreted like this and that decree and contract's modifications secured this. But it observed that the risk of obtention by American public authorities was remaining. 

Because public order requires the maintenance of this platform and that it does not exist for the moment other technical solution, the Conseil d'Etat maintained the principle of its management by Microsoft, until a European operator is found. During this, the control by the CNIL (French Data Regulator), whose the observations has been taken into consideration, will be operated. 

We can retain three lessons from this great decision:

• There is a perfect continuum between Ex Ante and Ex Post, because by a referred, the Conseil d'Etat succeed in obtaining an update of the decree, a modification of the contractual clauses by Microsoft and of the words of the Minister in order to, as soon as possible, the platform is managed by an European operator. Thus, because it is Compliance Law, the relevant time of the judge is the future. 
• The Conseil d'Etat put the protection of people at the heart of its reasoning, what is compliant to the definition of Compliance Law. It succeeded to solve the dilemma: either protecting people thanks to the person to fight against the virus, or protecting people by preventing the centralization of data and their captation by American public authorities. Through a "political" decision, that is an action for the future, the Conseil found a provisional solution to protect people against the disease and against the dispossession of their data, requiring that an European solution is found. 
• The Conseil d'Etat emphasized the Court of Justice of The European Union as the alpha and omega of Compliance Law. By interpreting the contract between a GIP (Public interest Group) and an Irish subsidy of an American group only with regards to the case law of the Court of Justice of European Union, the Conseil d'Etat shows that sovereign Europe of Data can be built. And that courts are at the heart of this. 

___________

Read the interview given on this Ordinance Health Data Hub

To go further about the question of Compliance Law concerning health data protection, read the news of 25th of August 2020: The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection 

Full reference: Serious Fraud Office, Operational Handbook about Deferred Prosecution Agreements, October 2020

Read the Operational Handbook

Full reference: Petit, N., Droit européen de la concurrence, 3rd edition, Collection "Précis Domat Droit Public/Droit privé", LGDJ-Lextenso, 2020

Read the forth of cover (in French)

Read the table of contents (in French)

Résumé de la leçon.

Le Droit de la Compliance semble être synonyme d"extraterritorialité, en ce qu'il se fit connaître d'une façon spectaculaire en 2014 par la décision américaine sanctionnant la banque française BNPP.  L'on a dès lors souvent assimilé "Compliance" et extraterritorialité du Droit américain, englobant les deux dans la même opprobre.Celle-ci est par exemple d'une grande violence dans le rapport dit "Gauvain" de 2019. Mais sauf à croire que le Droit n'est que l'instrument pur du Politique, en raison des "buts monumentaux" poursuivis par le Droit de la Compliance, celui-ci ne peut avoir en tant qu'instrument qu'une portée extraterritoriale, sauf à être utilisé par une Autorité locale pour ne servir qu'un but local. Dans cette hypothèse, précise et restreinte, l'extraterritorialité du Droit de la Compliance doit être combattue, ce qui est fait par la Cour de la Haye dans sa jurisprudence de 2018. Mais pour résoudre cette question particulière, l'on risque de détruire l'idée même de Droit de la Compliance, lequel suppose l'extraterritorialité. Et au moment même où le continent asiatique est en train d'utiliser le Droit de la Compliance dans une définition mécanique pour mieux s'isoler. 

Si l'on prend les autres sujets sur lesquels porte le Droit de la Compliance, lequel excède la question des embargos, l'on peut même soutenir qu'il a été fait pour ne pas être brider par les territoires, lesquels sont à la fois l'ancrage des Etats et leur intrinsèque faiblesse. L'internalisation dans les entreprises permet cela. Elle le permet tout d'abord par le mécanisme de "l'autorégulation". En effet, si l'on fait un lien, voire une identification entre la Compliance, l'éthique et l'autorégulation, alors la question des frontières ne se pose plus. Ainsi, l'entreprise s'auto-instituant non seulement comme un "néo-constituant" mais comme un ordre juridique complet, y compris dans le règlement des différents et dans les voies d'exécution (enforcement par le bannissement). La question de l'efficacité est donc réglée mais ouvre alors celle de la légitimité.  C'est pourquoi l'Europe a vocation à porter une conception extraterritoriale d'une définition pourtant européenne de ce qu'est le Droit de la Compliance. C'est ce à quoi les arrêts de la Cour de justice de l'Union européenne du 24 septembre 2019 viennent de mettre un coup d'arrêt. 

Se reporter à la Présentation générale du Cours de Droit de la Compliance.

Consulter le Dictionnaire bilingue du Droit de la Régulation et de la Compliance et la Newsletter MAFR - Law, Compliance, Regulation.

Consulter la Bibliographie générale du Cours de Droit de la Compliance

Consulter la bibliographie ci-dessous, spécifique à cette Leçon relative aux enjeux pratiques du Droit de la Compliance

Full reference: Financial Stability Board, The Use of Supervisory and Regulatory Technology by Authorities and Regulated Institutions. Market Developments and Stability Implications, Report of 9th of October 2020, 36 p. 

Read the report

Read the presentation of the report by the Financial Stability Board

To go further on the question of the use of new technologies in regulatory processes, read Marie-Anne Frison-Roche's working paper: Analysis of blockchains with regards with the uses they can fulfill and the functions that the ministerial officers must ensure  

Full reference: CJEU, Grand Chamber, 6th of October 2020, Privacy International c/ Secretary of State for Foreign and Commonwealth Affairs, C-623/17.

Read the judgment 

Read the summary of the judgment (in French)

Read the opinion of the Advocate General 

Read the reference for a preliminary ruling from the Investigatory Powers Tribunal - London (United Kingdom)

Full reference of the guidelines: Commission Nationale de l'Informatique et des Libertés (CNIL), Délibération n°2020-091 du 17 septembre 2020 portant adoption de lignes directrices relatives à l'application de l'article 82 de la loi du 6 janvier 1978 modifiée aux opérations de lecture et écriture dans le terminal d'un utilisateur (notamment aux "cookies et autres traceurs") et abrogeant la délibération n°2019-093 du 4 juillet 2019 

Full reference of the recommendation: Commission Nationale de l'Informatique et des Libertés (CNIL), Délibération n°2020-092 du 17 septembre 2020 portant adoption d'une recommandation proposant des modalités pratiques de mise en conformité en cas de recours aux "cookies et autres traceurs". 

Read the guidelines (in French)

Read the recommendation (in French)

Read the presentation of these guilines and of this recommendation by the CNIL (in French) 

Read Marie-Anne Frison-Roche's comment about this in the Newsletter MAFR - Law, Regulation & Compliance of 1st of October 2020

Full reference: Frison-Roche, M.-A., Judge between Platform and Regulator: current example of Uber case in U.K., Newsletter MAFR - Law, Compliance, Regulation, 29th of September 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news:

On 22nd of September 2017, Transport of London (TFL), London Transport Regulator, refused to renew the licence, granted on 31st of May 2012 for 5 years, authorizing Uber to transport people because of criminal offenses committed by Uber's drivers. On 26th of June 2018, The Westminster Court prolonged Uber's licence for 15 months under the condition that the platform prevent the reproachable behaviors of its drivers. After these 15 months, the TFL refused once again to prolonge Uber's licence because of the persistence of aggressions against passengers. Uber, once again, contest this decision before the Westminster Court. 

In a decision of 28th of September 2020, the Court observes that during the 15 months, the platform implemented many measures to prevent aggressions, that the level of maturity of these measures has improved over time and that the number of offenses was reduced over the period (passing from 55 in 2018 to 4 in 2020). The Court estimated the the implementation of this actions is sufficient to grant a new licence to Uber. 

We can learn three lessons from this decision: 

1. The Compliance obligation is not a result obligation but a mean obligation, which means that it is not reasonable to expect from a crucial operator (Uber, for instance) that it prevent every cases of agression but that it is salient to judge it on the effort it deploys to try to be closer to this ideal situation. Moreover, the crucial operator must be proactive, that is going away from the figure of passive subject of Law who apply measures enacted by the regulator in terms of fighting against aggressions to be an actor of the research of the best way to fight abusive behaviors, internalizing this "monumental goal. 
2. The judge appreciates the violation committed by those whose the firm is responsible "in context", that is evaluates the concrete situation in a reasonable way. 
3. It is the judge who decides in last resort and like the crucial operator, it must be reasonable. 

Read to go further:

• Frison-Roche, M.-A., Firm, Regulator and Judge: thinking Compliance through these three characters, 2018
• The report of the Assemblée nationale (French Parliament chamber) on the question 

Full reference: Giuliani-Viallard, A., The Europe of Compliance, at the heart of tomorrow's world. For a transformation of our European businesses and the upturn in their international competitiveness, European Issue, n°572, policy paper from the Robert Schuman Foundation, 28th of September 2020, 3 p.

Read the policy paper

Full reference: Constitutional Court of Belgium, 24th of September 2020, Décision concernant le recours en annulation partielle de la loi du 18 septembre 2017 relative à la prévention du blanchiment de capitaux et du financement du terrorisme et à la limitation de l'utilisation des espèces (decision concerning the partial annulment appeal of the law of 18th of September 2017 related to money laundering and terrorism financing prevention and to the restriction of the use of cash), n°114/2020

Read the decision (in French)

Read the law of 18th of September 2017 (in French)