Thank you Gaetan Goldberg for flagging that the French Supreme Court has confirmed on 19 June last, jurisdiction of the French Data Protection Agency (‘DpA’), CNIL for issuing its fine (as well as confirming the fine itself) imposed on Google for the abuse of data obtained from Android users. The Court was invited to submit preliminary references to the CJEU on the one-stop shop principle of the GPDR, but declined to do so.
Readers of the blog know that my interest in the GDPR lies in the jurisdictional issues – I trust date protection lawyers will have more to say on the judgment.
With respect to the one stop shop principle (see in particular A56 GDPR) the Court held at 5 ff that Google do not have a ‘main establishment’ in the EU at least not at the time of the fine complained of, given that the Irish Google office (the only candidate for being the ‘main establishment) at least at that time did not have effective control over the use and destination of the data that were being transferred – US Google offices pulling the strings on that decision. A call by the CNIL under the relevant EU procedure did not make any of the other DPAs come forward as wanting to co-ordinate the action.
On the issue of consent the SC referred to CJEU Cc-673/17 Planet49 and effectively held that the spaghetti bowl of consent, ticking and unticking of boxes which an Android user has to perform to link a Google account to Android and hence unlock crucial features of Android, do not amount to consent or proper compliance with GDPR requirements.
A short post to flag the French Conseil d’Etat’s final ruling in which on 7 February it held that organisms obtained via in-vitro mutagenesis techniques should be subject to GMO regulation and that consequently as EurActiv summarise the French authorities must update regulation to include such crops within six months, which includes identifying the agricultural plant varieties which have been obtained by these techniques and subjecting them to the assessments applicable to GMOs.
The ruling follows the CJEU’s mutagenesis finding in C-528/16, reviewed at the time on Steve Peers’ blog here and subsequently by KJ Garnett in RECIEL here. The ruling put agro-bio industry narrators in a spin but in essence is an utterly logical consequence of EU law.
Something to digest quietly, to start this new year: in Gaz de France v STS the French Conseil d’Etat annuled an arbitral award for breach of ordre public. The Conseil objected in particular to the panel’s denial of mandatory French (administrative) law. Reed Smith have analysis here, including of the issue on jurisdiction (Conseil d’Etat or Court de Cassation).
Upon reading the judgment, my question is this (just putting it in the group, as it were): does the Conseil have terminology right where it seems to classify breach of mandatory law as a violation of ordre public (it is the latter only which justifies annulment under the New York Convention)? Incidentally (at 5) it also refers to the possibility of mandatory EU law being part of this interpretation of ordre public. This structure is clearly inspired by the Rome I Regulation where, as I have noted before, the presence of mandatory law, overriding mandatory law, and ordre public, is causing confusion.
Happy New Year, happy reading, Geert.