FranceLoi Informatique et Libertés Article 82, Consent before Storing or Reading Information on a User's Terminal Equipment
Loi n° 78-17 du 6 janvier 1978, art. 82
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Before storing information on a user's device, or reading information already stored there, tell the subscriber or user clearly and completely the purpose of the action and the means to object, unless they have already been informed.
- Obtain the user's consent, given after that information, before you store or read the information. Consent may result from appropriate settings of the connection device or of any other device under the user's control.
- You need no consent where the sole purpose of the access or writing is to enable or facilitate communication by electronic means, or where it is strictly necessary for the supply of an online communication service at the user's express request.
If you get it wrong
Penalty structure
Article 20(IV) caps the CNIL's administrative fine for a breach of the Act at EUR 10 million or, for an enterprise, 2 % of total worldwide annual turnover for the preceding financial year, whichever is higher. In the cases of Article 83(5) and (6) of the General Data Protection Regulation those ceilings rise to EUR 20 million and 4 %.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Commission nationale de l'informatique et des libertés (CNIL), whose president may issue formal notices and whose restricted committee may impose the measures and fines in Article 20.
Settledness
The CNIL reads the consent referred to in Article 82 by reference to the definition and conditions in Articles 4(11) and 7 of the General Data Protection Regulation, so that it must be free, specific, informed and unambiguous and the user must be able to withdraw it at any time.
- As of
- Guidance link
- https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/que-dit-la-loi
- Guidance body
- Commission nationale de l'informatique et des libertés
What this law does
Article 82 requires the controller or its representative to inform every subscriber or user of an electronic communications service, clearly and completely, unless already informed, of the purpose of any action to access information already stored in the user's terminal equipment or to write information into it, and of the means to object.
The access or writing may take place only if the subscriber or user has given consent after receiving that information, and consent may result from appropriate settings of the connection device or of any other device under the user's control. The consent requirement does not apply where the access or writing has the exclusive purpose of enabling or facilitating communication by electronic means.
It also does not apply where the access or writing is strictly necessary for the supply of an online communication service at the user's express request. Under Article 20(IV) the CNIL's restricted committee may impose an administrative fine of up to EUR 10 million or, for an enterprise, 2 % of total worldwide annual turnover for the preceding financial year, whichever is higher, for a breach of the obligations resulting from the General Data Protection Regulation or from the Act.
Ordonnance n° 2018-1125 du 12 décembre 2018 replaced articles 1 to 72 of the Act with new text, of which Article 82 is part. Article 29 of the ordonnance brings its provisions into force at the same time as the decree amending décret n° 2005-1309 du 20 octobre 2005, and at the latest on . Article 159 of décret n° 2019-536 du 29 mai 2019 states that the decree enters into force on .
When LexLint raises it
When your app profile says your app tracks devices.