Data

Full reference: Frison-Roche, M.-A., Compliance by Design, a new weapon? Opinion of Facebook about Apple new technical dispositions on Personal Data protection, Newsletter MAFR – Law, Compliance, Regulation, 31st of August 2020 Read by freely subscribing other news of the Newsletter MAFR – Law, Compliance, Regulation   Summary of the news: Personal Data, as they are information, are Compliance Tools. They represent a precious resource for firms which must implement a vigilance plan in order to prevent corruption, money laundering or terrorism financing, for examples. It is the reason why personal data are the angular stone of "Compliance by design" systems. However, the use of these data cannot clear the firm of its simultaneous obligation to protect these same personal data, that is also a "monumental goal" of Compliance Law.  In order to be able to exploit these data in an objective of Compliance and protecting them in the same time, the digital firm Apple adopted for example new dispositions in order to the exploitation of the Identifier For Advertisers (IDFA) integrated in the iPad and in the iPhone and broadly used by targeted advertising firms, is conditioned to the consumer's consent. Facebook reacted to this new disposition explaining that such measures will restrict the access to data for advertisers who will suffer from that. Facebook suspects Apple to block the access to advertisers in order to develop its own advertising tool. Facebook guaranteed to advertisers who work with it that it will not take similar measures and that it will always favor consultation before decision making in order to concile sometimes divergent interests.  We can sleep and already make some remarks: GDPR imposing to companies that they guarantee a minimal level of protection for personal data does not apply in the United-States. It is then possible that Apple acted through Corporate Social Responsibility (CSR), more than through legal obligation.  The mode of regulation used here is the "conversational regulation" theorized by Julia Black. Indeed, regulators let the forces in presence discuss.  This "conversational regulation" does not seem to be very efficient in this case and an intervention of administrative authorities or of judges could be justified via Competition Law, Regulation Law or Compliance Law, knowing that Competition Law will favor access right to information and Regulation or Compliance Law private life right.  The whole paradox of Compliance Law rests in the equilibrium between circulation of information and secret. 

Full reference: Frison-Roche, M.-A., "Interregulation"​ between Payments System and Personal Data Protection: how to organize this "interplay"​?, Newsletter MAFR – Law, Compliance, Regulation, 27th of August 2020 Read by freely subscribing the other news of the Newsletter MAFR – Law, Compliance, Regulation   Summary of the news Regulation Law, in order to recognize and draw the consequences from the specificities of some objects, has been build, at the start, around the notion of "technical sector" although their delimitation is partially related to a political choice. But, in facts, there are multiple points of contacts between sectors, actors moving from one to another as objects. The regulatory solution is so to climb over some technical borders through the methodology of interregulation which is by the way the only one to enable the regulation of some phenomena going beyond the notion of sector and related to Compliance Law.  This news takes the exemple of companies furnishing new payment services. In order to they can provide these services, these firms needs to access to banking accounts of concerned people and so to very sensitive personal data. Regulation of such a configuration needs a cooperation between the banking regulator and the personal data regulator. Legislation being not sufficient to organize in Ex Ante this interregulation, the European Data Protection Board has published some guidelines on 17th of July 2020 about the way it conceives the articulation between the PSD2 (European directive about payment services) and GDPR and has announced that it intended to expand the circle of its interlocutors to do this interregulation. Such an initiative from EDPB can be justified by the uncertainty  about how interpreting both texts and articulating them.   

Full reference: Frison-Roche, M.-A., Being obliged by Law to unlock telephone is not equivalent to self-incrimination: Cour de cassation, Criminal Chamber, Dec. 19, 2019, Newsletter MAFR – Law, Compliance, Regulation, 21st of August 2020 Read by freely subscribing the other news of the Newsletter MAFR – Law, Compliance, Regulation   Summary of the news The Cour de Cassation (French Supreme Judicial Court) made a decision on 19th of December 2019 about a case concerning a refusal to communicate his mobile phone's unlock code to the police while the police found him with a significant quantity of narcotic and a lot of cash and that there was a certain probability that this mobile phone get proofs of culpability of its owner. The individual was indicted not for narcotic trafficking but for not having communicate its unlock code which constitute an offense to article 434-15-2 of code pénal, from the loi du 3 juin 2018 renforçant la lutte contre la criminalité organisée, et le terrorisme et leur financement (law reinforcing organized crime, terrorisme and their financing). The accused invokes before the court its right to not incriminate oneself. Indeed, the configuration face to policemen was such that if he refused to communicate its unlock code, he will be punished because of this obligation to communicate his code and that if he accepted, he will also be sanctioned because of the proofs contained into the mobile phone. Such a configuration therefore offered him no alternative to confessing, which is contrary to the European Convention on Human Rights and to European and national jurisprudence. Face to such a case, the Cour de Cassation chose to segment the information and proposed the following solution: if the researched information cannot be obtained regardless of the suspect willingness, it is not possible to constraint this person to communicate this information without violating its procedural rights, but if the information can be obtained regardless of the suspect willingness then the individual is obliged to communicate his code. In the current case, as it was possible for policemen to obtain information contained in the phone by technical means, longer but existent, then the refuse of communication of the unlock code by the suspect constitute an obstruction that should be sanctioned.  Such a decision is an exemple of the conciliation by the judge of two fundamental but contradictory "monumental goals" of Compliance Law: transparency of information towards public authorities and very sensible personal data protection.  ​To go further, read Marie-Anne Frison-Roche's working paper: Rethinking the world from the notion of data    

Full reference: Féral-Schuhl, C., Cyberdroit. Le Droit à l'épreuve de l'internet, Collection Praxis Dalloz, Dalloz, 8th edition, 2020, 1731p.   Read the forth of cover (in French) Read the table of contents (in French)

Among all the things that were important to remember, one of the things that struck me most in the extraordinary conference of the President of the Court of Justice of the European Union Koen Lenaerts on "Europe of the Compliance "held on March 2, 2018 was his ability to make" live Europe ". Not only to make it understand but also to make it "live". Here is the challenge: that compliance is not an accumulation of processes without reason and without flesh, but a living whole taking its meaning into consideration of the human being, a person whose judge is concerned. On 2 March 2018, Koen Lenaerts therefore came to an amphitheater at the University Panthéon-Assas (Paris 2) to inaugurate the series of conferences organized by the Journal of Regulation & Compliance (JoRC), a cycle that has the general title: Pour une Europe de la Compliance (For the Europe of Compliance). The School of Public Affairs of Sciences Po, the Department of Economics of Sciences Po, the Ecole doctorale de droit privé  (Doctoral School of Private Law) at the Université Panthéon-Assas- Paris 2 (Panthéon-Assas University – Paris 2) and the School of Law of the University Panthéon-Sorbonne (Paris I), are associated with this cycle. Many personalities will take the floor. Presented by Professor Thierry Bonneau, the conference made by President Koen Lenaerts was extremely rich and solid, perfectly constructed. Everyone had known the quality of the conference to be delivered by the President of the CJEU. The content of his demonstration will be found in the article he will give for the book that will be published in the Régulations & Compliance Series edited by Marie-Anne Frison-Roche at Éditions Dalloz. And the reader will find all the strength of this demonstration. This is necessary to venture into this area of "Compliance" : Koen Lenaerts recalled that we were still looking for the definition and a French term that would do justice to a satisfactory definition¹Frison-Roche, M.-A., Compliance Law, 2016.. This question was echoed by Antoine Garapon in his discussion. Embodying the firmness that must be shown when words are uncertain, President Koen Lenaerts emphasized that the European Union is based on "Rule of Law". This means that the behaviors must respect Law. For that, – and that is why it is necessary to take in the literal sense the English expression "to comply with", the enterprise must not be passive but to make sure that its behavior is actually respectful of legal prescriptions. In this, there is a general paradigm shift, which inverses the relation betwenn the operator and the rules, from the Ex Post to the Ex Ante²On this passage, which internalises the "Regulatory Law" in the company, c. not. Frison-Roche, M.-A., From Regulation Law to Compliance Law, 2017, and the book, Régulation, Supervision, Compliance (Regulation, Supervision, Compliance), 2017.  as the entreprise has to be itself active to secure the effectiveness of the rule of Law. This internalization of the rule by the company develops both a procedural culture and a behavioral culture, in which companies can express an ethical dimension and build a "Trust Pact" ³About this notion, s. Frison-Roche, M.-A., Compliance and Trust, 2017 ; Drawing the Circles of Compliance Law, 2017. with states and public authorities. This change has been brought about by globalization, since states no longer have the means to impose ethical norms of behavior on businesses through the Ex Post intervention of their jurisdiction, but States like companies are gaining the benefit of this internalisation of rules in compagnies because the Compliance is inseparable from the accountability by which the company is compelled to justify that it actually tends to achieve the overall goals assigned by the public authority. Thus, after exposing the general movement by which Europe opened up to this upheaval, President Koen Lenaerts took on three technical dimensions crossed by this new conception. The first is the Financial Markets Law. The second is Competition Law, about which the President has notably developed the Court's reflections on whether the adoption of a compliance program by an enterprise found to have violated Competition Law, in particular by "negligence" is neutral, or constitutes a mitigating circumstance or constitutes an aggravating circumstance. This question was taken up after the presentation in the discussion with the room. The third is that of personal data. Taking again as in a waltz with three times his remarks, the president of the Court of Justice found that the compliance, whereas it consists in transforming the Ex Post into Ex Ante becomes juridicalised and in this the Court of justice holds its not only in Europe but also in relation to the world, without however ever forgetting that it is the States that are drawing up the rules that are the foundation of Europe. We will find in the article that will be published all these precious elements and no doubt that the elegance of the pen will be equal to that of speech. But, written exercise requires, the reader will not find what we had the chance to attend: the story of two cases by the one I would prefer to name the "Professor Koen Lenaerts". Two famous cases, which we teachers, comment and remind in our courses, that students learn and recite, quote in their copies. But never that way. The first case is the Schrerms case, where the court said that Facebook could not transfer this person's personal data to the United States since he was opposed to it. To make it clear, the President revived it through the litigant, who was a student and for this reason he spoke directly to the students present in the amphitheater. He pointed out that the plaintiff at the origin of the case was a law student, like them. He detailed his situation in Austria, making some quotes in perfect German, pointing out that this student was now at the doctoral stage, inviting students to be brave, as he was. At each episode of the story, the speaker told the students, making some detours on his own student life because finally we were all in family … Alma Mater. But his hands were telling the story even more: they were thrown themselves into the story, they brewed the space, it seemed as if they themselves were no more grandiloquent than the speaker but found their place exactly , in a magisterial position. Yes, here is a president in front of which companies have a hard time hiding the truth, a president with such firm hands and whose torso does not move but turns to the left and right to talk to everyone. The second story was even more beautiful. The Google Spain case, I know it. I even know it by heart. I read it, commented on it, cited it a lot of times … But all of a sudden that's what happened to a small Spanish merchant: President Koen Lenaerts told us his story, and I rediscovered the case. A small Spanish shopkeeper, whose name the speaker uttered in perfect Spanish, obtained from the Court of Justice that his "right to be forgotten" was recognized. President underlined the apparent paradox of his  insistence for the appearance of his surname in the judgment by which this person had thus obtained the erasing of his surname! Yes, I did not notice … Why did he ask for the mention of his name in the right to have his name deleted? Because it's a matter of honor. This is what the speaker insisted: do not joke with honor. And if you do, even Google will lose. The merchant had been subject to a forced property sale procedure because of financial difficulty, which spanish newspapers had echoed. His honor was been trampled. Then, by a happy return of fortune, he had recovered his property, his prosperity, his reputation. But from that, the press had not talked about it. Some lines in a newspaper of legal announcements, but that it is nothing for the human soul. That's why he wanted these mechanical digital links to disappear, which always and for all end up with articles presenting him as a wretch without ever ending up with articles presenting him as a prosperous merchant (because of the non-existence of these second articles). The speaker emphasized this dimension very much. And we know that the General Regulations that will come into force in May 2018 on personal data, which intrigues so much the Americans, draws in the judgment Google Spain its main solution in the matter: this "right to be forgotten" , subjective right so strange. He emphasized this dimension very much. And we know that the General Regulations that will come into force in May 2018 on personal data, which intrigues so much the Americans, draws in the judgment Google Spain its main solution in the matter: this "right to be forgotten" , subjective right so strange. Listening to President Koen Lenaerts, how not to think of Carbonnier? to  his articles of it, especially on sociological rule : "small causes, great effects"? From this conference, it will remain a great article, but as in the theater, where the ephemeral is part of the beauty of this art, what were these two stories, told by the one who knew how to listen when it was necessary to decide the two cases, stories told with the two firm hands that danced inviting students to enter this round, even as the President of the Court of Justice had to leave immediately to Luxembourg to hold such heavy obligations, yes it was simply beautiful .    

This Working paper will be used to support an  French written article to be published in a book, set in the Regulations Series, Dalloz Publishing This working paper was the basis for intervention in the symposium organized by the Journal of Regulation, Internet, Space of Interregulation. View the slides used as support at the conference (in French). -   After emphasizing that the concept of "data" is uncertain, the first perspective is to draw the regulatory consequences of the fact that what is often referred to as the "object" of the data item (the person, the company for financial data, the economy for rating data, etc.), is only its source, "underlying", the data which is manufactured by a company : the real objet of the data is  its purpose being the use for which the data is intended. The data is independent its underlying, is consolidated in the affected masses, takes an economic value based on the desires that have users, becomes available outside of time and space in the digital. This implies a specific interregulation. But the data is also the Janus of digital because new black gold, pure financial instrument, immaterial by nature, the data also keep a record of people, the underlying that would protect, that we would like inseparable, or the structure that one would want legitimately to attack thank to the new mechanism of compliance. This double-sided of the data item leads to shocks of regulatory mechanisms in Internet In addition, any Internet links back to the user, in whom we would gladly see "The Grand Interregulato" ". But is it so appropriate, legitimate and effective? The "consent" which refers this interregulation provided by the user himself raises doubts. However, as the displaced term of "right to be forgotten" hides a very effective weapon that can strike those who monopolize the data in a digital economy that seems to be in an ante-market mechanism. This regression pulverizes the market self-regulation itself to replace the legal acts of exchange by connective legal acts, that for now Law and Regulation are struggling to understand, lack of legal qualifications to do so.  

Law is a reconstruction of the world through definitions and categories, expressed in words, to which are imputed rules. There is always a share of invention in Law, articulated to a share of fidelity to the concrete world that it retranscribes, a combination enabling Law to regulate the latter. Law is put in difficulty by what the term "data", quite new, is not easy to define. The fact that it is strangely formulated in Latin to show that there is plurality, the data, before associating it with an English adjective when there are many, the "big data", does not advance us more on what a "data" is. Law is a practical art that works well only if it manipulates categories whose definition is mastered. This is why, in a first stage, we must recognize the uncertainties of the very notions of "data" (I), in order to orientate the adequate rules in the second step towards what is a given, namely a "pure" value in our consumer information society (II).   Read the article written in French on the basis à this working paper