(English) Does the absence of a CNIL declaration affect the sale of a file?
(English) Does the absence of a CNIL declaration affect the sale of a file?
Désolé, cet article est seulement disponible en Anglais Américain. Pour le confort de l’utilisateur, le contenu est affiché ci-dessous dans une autre langue. Vous pouvez cliquer le lien pour changer de langue active.
By Stéphanie CHARLES
The French Supreme Court recently answered this question in a ruling dated 25 June 2013, in which it stated that the sale of an undeclared file must be cancelled.
The contested sale pertained to a client file which ought to have been declared with the French Data Protection Authority (CNIL) since it contained personal data. Having noticed that this rule had not been complied with, the Court found such a file to be illegal and unable to be subject to a convention under the French Civil Code. Its sale must therefore be considered null and void and the assignor will be required to reimburse the amount of the assignment.
This ruling is particularly important in that it is the first time that the Court has applied such reasoning.
The repercussions of this ruling can be felt at several levels:
– As an undeclared personal data file is deemed to be “not in commerce”, this, in real terms, implies the neutralization of the entire financial value of said file, which has an automatic impact on the corporate intangible assets;
– The illegal nature of an undeclared file is a cause for absolute nullity of any use, transfer and/or availability of said file. This means that anyone, even if uninvolved in the transaction, but wanting to act on it, can petition the nullity of the assignment. Consequently, a person who is referenced on a contested file can petition the nullity of such a sale;
– Thus, for 5 years, an agreement on an illegal file can be questioned by anyone, and the amount of the agreement must be returned. The question of legal insecurity therefore arises whenever the issue of compliance with CNIL rules is not verified beforehand.
This ruling reminds us of the importance of complying with the obligations attached to the handling of personal data, which, in addition to the declaration filed with the CNIL, must fulfill certain conditions and formalities (obligations of information, opt-in rules, data security measures, limited data storage duration…). Non-compliance with these rules can affect the corporate intangible assets to which it relates, and result in criminal penalties.
Key points :
– On the one hand, if you sell your files, you run the risk of having to reimburse the cost of the transaction if you have not respected the declaration rules,
– On the other hand, if you bought such data, there may be some funds to collect if the files you purchased were not declared!
Retour