As reported in a previous blog post, the new French Digital Republic Bill (Bill) came into force on 7 October 2016, which had the effect of amending article L. 32-3 IV of the code of electronic communication in relation to the secrecy of correspondence. In particular, the Bill:
- Extends the obligation of secrecy to OTTs (thus, it is no longer limited to telcos)
- Defines what elements are protected by confidentiality (i.e., the content, the identity of the correspondents and, if applicable, the header of the message and the attached documents)
- Defines the use that can be made with the consent of the user (automated analysis for advertising, statistics or service improvement)
- Defines the type of consent (express, specific to each processing and at least once a year)
A decree of 28 March 2017 modifies article D. 98-5-I of the code to require that consent be obtained from the user every year. Where telcos or OTTs are already using such data before 1 April 2017 (the date on which the new rules come into force), they will need to obtain users’ consent for the first time on or before 1 August 2017.
The changes outlined above are material. Stakeholders must now organise the periodic collection of consent, which must be obtained expressly and specifically for each purpose. The process has to be separate from any consent to the terms and conditions or other policies. Our specialist Data Privacy & Cybersecurity team in Paris can advise on how the changes could affect you.