Administrative Fine Concerning Installation of Cookies. Comment on the Order of the National Commission for Information Technology and Freedoms in France (CNIL) of 7 December 2020 in the Amazon Europe Core Case, SAN-2020-013

Abstract

The legal problem of the use of online identifiers such as cookies is one of the most frequently addressed in the context of protecting the privacy and personal data of users of electronic communications services. In recent years, the principles of their use have been the subject of a number of decisions of the Court of Justice of the European Union (CJEU), as well as decisions issued by regulatory bodies in several EU countries. An important decision in this regard was issued on December 7, 2020 by the French data protection authority – National Commission for Information Technology and Freedoms (CNIL), imposing on Amazon company an administrative fine for violating French cookie laws (reference SAN-2020-013).

In the context of the above decision, the specificity of the solutions adopted by the French legislator should be underlined. First, the CNIL has been empowered by the French Data Protection Act to enforce not only the provisions of the GDPR, but also the provisions implementing Directive  2002/58/EC.  Secondly,  the  territorial  jurisdiction  of  the  French  legislation  in  matters  falling under the scope of the ePrivacy Directive follows the same rationale as Article 4 of Directive 95/46/EC, subsequently repealed by the GDPR provisions.

For the foregoing reasons, the reasoning put forward by the French data protection authority cannot be applied to cases decided under the legislation of those European Union members states which have transposed the provisions of Directive 2002/58/EC into the sectoral regulation of  electronic  communications  and,  unlike  the  French  legislator,  have  not  introduced  rules  in  their legislation designating territorial jurisdiction in such cases. An example is the Polish legal system,  where  the  provision  of  Article  5(3)  of  Directive  2002/58/EC  has  been  implemented  in  Article 173 of the Act on Telecommunications Law.