Search results (1699 cards)

Advanced search

Full reference: Frison-Roche, M.-A., Conditions for the legality of a platform managed by an American company hosting European health data​: French Conseil d'Etat decision, Newsletter MAFR - Law, Compliance, Regulation, 19th of October 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

___

News Summary: In its ordinance of 13th of October 2020, Conseil national du logiciel libre (called Health Data Hub), the Conseil d'Etat (French Administrative Supreme Court) has determined the legal rules governing the possibility to give the management of sensitive data on a platform to a non-europeans firm, through the specific case of the decree and of the contract by which the management of the platform centralizing health data to fight against Covid-19 has been given to the Irish subsidiary of an American firm, Microsoft. 

The Conseil d'Etat used firstly CJEU case law, especially the decision of 16th of July 2020, called Schrems 2, in the light of which it was interpreted and French Law and the contract linking GIP and

The Conseil d'Etat concluded that it was not possible to transfer this data to United-Sates, that the contract could be only interpreted like this and that decree and contract's modifications secured this. But it observed that the risk of obtention by American public authorities was remaining. 

Because public order requires the maintenance of this platform and that it does not exist for the moment other technical solution, the Conseil d'Etat maintained the principle of its management by Microsoft, until a European operator is found. During this, the control by the CNIL (French Data Regulator), whose the observations has been taken into consideration, will be operated. 

We can retain three lessons from this great decision:

• There is a perfect continuum between Ex Ante and Ex Post, because by a referred, the Conseil d'Etat succeed in obtaining an update of the decree, a modification of the contractual clauses by Microsoft and of the words of the Minister in order to, as soon as possible, the platform is managed by an European operator. Thus, because it is Compliance Law, the relevant time of the judge is the future. 
• The Conseil d'Etat put the protection of people at the heart of its reasoning, what is compliant to the definition of Compliance Law. It succeeded to solve the dilemma: either protecting people thanks to the person to fight against the virus, or protecting people by preventing the centralization of data and their captation by American public authorities. Through a "political" decision, that is an action for the future, the Conseil found a provisional solution to protect people against the disease and against the dispossession of their data, requiring that an European solution is found. 
• The Conseil d'Etat emphasized the Court of Justice of The European Union as the alpha and omega of Compliance Law. By interpreting the contract between a GIP (Public interest Group) and an Irish subsidy of an American group only with regards to the case law of the Court of Justice of European Union, the Conseil d'Etat shows that sovereign Europe of Data can be built. And that courts are at the heart of this. 

___________

Read the interview given on this Ordinance Health Data Hub

To go further about the question of Compliance Law concerning health data protection, read the news of 25th of August 2020: The always in expansion "Right to be Forgotten"​: a legitimate Oxymore in Compliance Law built on Information. Example of​ Cancer Survivors Protection 

Full reference: Frison-Roche, M.-A., Responding to an email with "serious anomalies"​,transferring personal data, blocks reimbursement by the bank: French Cour de cassation, July 1st 2020, Newsletter MAFR - Law, Compliance, Regulation, 10th of September 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

"Phishing" is a kind of cyber criminality aiming to obtain, by sending fraudulent emails which look like to those sent by legitimate organisms, recipient's personal information in order to impersonate or steal him or her. As it is difficult to find the authors of "phishing" and to prove their intentionality in order to punish them directly, on mean to fight against "phishing" could be to entitle banks to secure their information network and, to accompany this obligation with a strong incentive, to convict them to reimburse the victims in case of robbery of their personal data.  

In 2015, a client victime of this kind of fraud asked to his bank, the Crédit Mutuel, to reimburse him the amount stole, what the bank refused to do on the grounds that the client committed a fault, transferring its confidential information without checking the email, however grossly counterfeit. The Court of first instance gave reason to the client because although he committed this fault, he was in good faith. This judgment was broken by the Chambre commerciale de la Cour de cassation (French Judicial Supreme Court) by a decision of 1st of July 2020 which states that this serious negligence, exclusive of any consideration of good faith, justifies the absence of reimbursement by the bank.

___

From this particular case, we can draw three lessons: 

1. The Cour de Cassation states that good faith is not a salient criterion and that, as the bank must react when a banking account is objectively abnormal, the client must react face to an obviously abnormal email. 
2. The Cour de Cassation describes the repartition of proof burden. Proof obligations are alternatively distributed between the bank and its client. First, the bank must secure its information network but, secondly, the client must take every reasonable measure to preserve its safety. It results from this that, if the email seems normal, phishing damages must be supported by the bank, and more generally of by the firm, while if the email is obviously abnormal, they must be supported by the client, but the burden to prove the abnormality of the email must be supported by the firm and not by the client. 
3. Such a proof system shows that Compliance Law includes a pedagogic mission by educating each client in order to he or she would be able to distinguish among his or her emails, those which are normal and those which are obviously suspect. This pedagogic dimension, with the legal consequences associated to it, will not stop to spread. 

______

Full reference: Frison-Roche, M.-A., Regulators'​ Impartiality and contents control: "Les infidèles"​ case, Newsletter MAFR - Law, Compliance, Regulation, 19th of August 2020

Read by freely subscribing the other news of the Newsletter MAFR - Law, Compliance, Regulation

To go further, read the chapter of the book Compliance Tools: "The geographical pregnancy ​of Compliance tools" opened by an introductive chapter written by Jean-Baptiste Racine

Summary of the news

Impartiality of the regulator is one of the most important principles of Regulation and Compliance Law. However, this impartiality can be difficult to implement when the regulation object has a strong moral dimension. 

In August 2020, various religious associations sized the Conseil National de Régulation de l'Audiovisuel sénégalais (Senegalese audiovisual regulatory authority) to ask the interdiction of broadcasting on television of the film "Les infidèles" telling the story of a married woman with multiple lovers. 

First, the regulator distinguishes the sequences likely to be detrimental to cultural and religious identities and shocking sequences or likely to attack the dignity of the person. Then, it asks the deletion of indecent and obscene scenes and of scenes likely to be detrimental to cultural and religious identities, bans the broadcasting of the film in the television before 10.30 pm, asks an update of the trailer and requires the introduction of a pictogram "forbidden to children under 16" during the broadcasting. The CNRA judges itself able to regulate the content of telefilms in order to protect cultural identities with regards to the law of 4th of January setting its mission. 

In 2012, a similar controversy surrounded, in France, the broadcasting of a different film with the same name. However, the purpose and the context were very different because the film was broadcasted at cinema, because it presented adultery men, because it was comic, because the competent regulator was not an administrative body but a professional body and because the broadcasting country was not the same. Here, only the poster was modified. 

Thus, an impartial regulation must however taking into consideration "local cultural identities".  

Full reference: Frison-Roche, M.-A., Risk Mapping: is it legally different when it is made by Regulatory Bodies or by Regulated Enterprises?, in  Newsletter MAFR - Law, Compliance, Regulation, 17th of August 2020

Read, by freely subscribing, other news of the Newsletter, MAFR - Law, Compliance, Regulation

Summary of the news

Each year, the Autorité des marchés financiers (French financial markets regulator), the European Central Bank and the Agence française anti-corruption (French anti-corruption agency) publish risk maps. At first glance, risk maps established by the regulator aim to both help regulator and the regulated company to face risks by anticipating them. These documents would only be an assistance brought to firms in their Compliance mission and not an injunction from the regulator to take into account the risks that it emphasizes.  

However, Law forces firms to do their own risk maps under penalty of sanctions. Since the regulator has previously published its own risk map, can companies, obliged to write theirs, deviate from it? If the firm follows the map published by the regulator, can it protect itself against this if it is accused of not having fulfilled its compliance obligations? On the contrary, if the operator does not follow regulator's risk map, can this be blamed on it? Formally, regulator's risk maps do not come with an injunction to take it into account but, as everyone knows, any recommendation from a regulator or supervisor must be taken into account.

The legal solution could here be the implementation of a system of "comply or explain" which would mean that if the firm decides to no follow the risk map established by the regulator, it must be able to justify its choice. 

To go further, read:

• Frison-Roche, M.-A., Legal Theory of Risk Mapping, center of Compliance Law, working paper, 2020

Full reference: Frison-Roche, M.-A., New SEC Report to Congress about Whistleblower Program: what is common between American and European conception, Newsletter MAFR - Law, Compliance, Regulation, 1st of December 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

Like every year since the adoption of the Dodd-Frank Act, the Securities and Exchanges Commission (SEC) and especially its Office of the Whistleblowers (OWB) handed to the Congress of the United-States a report about the success of its program concerning whistleblowers, especially estimated with the amount of financial rewards granted to them during the year. This report especially presents the amount granted to whistleblowers, the quality of the collected information and the efficacy of SEC's whistleblowers' protection process.

If Americans condition the effectiveness of whistleblowing to the remuneration of whistleblowers, Europeans oppose the "ethical whistleblower" who shares information for the love of Law to the "bounty hunter" uniquely motivated by financial reward and favor the former to the later, as it is proven in the French Law Sapin II of 2016 (which do not propose financial reward to whistleblowers) or the British Public Interest Disclosure of 1998 (which just propose a financial compensation of the whistleblower's losses linked to whistleblowing). 

However, American and European conceptions are not so far from each other. As United-States, Europe has a real care for legal effectivity, even if, because of their different legal traditions, Americans favor effectivity of rights while European favor effectivity of Law. If it places effectivity at the center of its preoccupations, Europe should conceive with less aversion the possibility to financially incite whistleblowers. Moreover, United-States and Europe share the same common willingness to protect whistleblowers and if rewarding would enable a better protection, then Europe should not reject it, as shows the recent declarations of the French Defenders of Rights. It is not excluded that both systems converges in a close future. 

Full reference: Frison-Roche, M.-A., Difficulty of Compliance in Self-Regulation system: example of the Summer 2020 meetings of OPEC about the "conformity"​ for Oil Market Stability​, Newsletter MAFR - Law, Compliance, Regulation, 26th of August 2020

Read by freely subscribing other news of the Newsletter MAFR - Law, Compliance, Regulation

Summary of the news

The world production of oil is largely coordinated by the Organization of the Petroleum Exporting Countries (OPEC) and especially by its Joint Ministerial Monitoring Committee (JMMC). On 15th of July 2020, this Committee decides to reduce the world production of oil in order to maintain a certain price stability in a context of restricted demand because of the COVID-19 pandemic. 

However, such a stability can be maintained only if each member respects this decision and effectively reduce its production level. This meeting of 15th of July also aimed to get member's conformity. In order to get this conformity, the JMMC declared that it will use "name and shame", shaming countries which do not respect the Committee's declaration and naming those which respect it. A second meeting, on 19th of August 2020, reminded to non-compliant countries their obligation and urged them to comply before the 28th of August. 

We can observe two things: 

• The term used by the Committee is "conformity" and not "compliance", which implies less adherence to "monumental goals than the mechanical respect of formal rules.
• In an self-regulation system where there is not supposed to be a need for "conformity", the need for it is a clue that this self-regulation is malfunctioning.

Complete reference: KOVAR, Jean-Philippe and LASERRE CAPDEVILLE, Jérôme, Droit de la régulation bancaire (Banking regulatory Law) , preface by Christian Noyer, RB Éditions, 333 p.

Read the coverback.

Read the table of contents.

ENGLISH

The Direction générale de la concurrence, de la consommation, et de la repression des fraudes (DGCCRF – The French Directorate General for Competition, Consumer Affairs, and Repression of Fraud) organized a Competition Workshop on the theme “Transportation and Competition” that took place at the Ministry of Economics, Finance, and Industry, in Paris, on December 16, 2010. These workshops, which are half-day conferences on a given theme, have been organized by the DGCCRF multiple times a year on various themes since 1994. This event was chaired by Anne Wachsmann, a lawyer at Linklaters, and Christophe Lemaire, a teaching assistant at the Law School of the Sorbonne, and a lawyer at Ashurst.

FRENCH

Fiche bibliographique (transports) : La Direction générale de la concurrence, de la consommation, et de la répression des fraudes a organisé un Atelier de la Concurrence sur le thème "Transports et Concurrence"

La Direction générale de la concurrence, de la consommation, et de la répression des fraudes a organisé un Atelier de la Concurrence sur le thème "Transports et Concurrence" qui a eu lieu au Ministère de l'Economie, des Finances et de l'Industrie à Paris, le 16 décembre 2010. Ces ateliers, qui sont des colloques d'une demie-journée sur un thème donné, sont organisés par la DGCCRF plusieurs fois par an depuis 1994. Cet atelier a été présidé par Maître Anne Wachsmann, avocat chez Linklaters, Paris, et Maître Christophe Lemaire, maître de conférences à l'Ecole de  Droit de la Sorbonne et avocat chez Ashurst, Paris.

GERMAN

Die Direction générale de la concurrence, de la consommation, et de la repression des fraudes (DGCCRF – die französische Hauptleitung für Wettbewerb, Konsumierung und Betrugsahndung) hat ein Wettbewerbsarbeitstreffen um dem Thema « Verkehr und Wettbewerb » organisiert. Er fand statt im Gebäude des Minsisteriums für Wirtschaft, Finanz und Industrie in Paris am 16. Dezember 2010. Solche Arbeitstage, die eigentlich ein halbes Tag lang dauern, wurden seit 1994 bei der DGCCRF mehrmals im Jahr organisiert. Diese Konferenz wurde von Anne Wachsmann, Rechtsanwältin für Linklaters, und Christophe Lemaire, wissenschaftlicher Mitarbeiter an der Sorbonner Rechtsschule, und Rechstanwalt für Ashurst, geleitet. 

SPANISH

La Directiva general francesa para la competencia, asuntos del consumidor y la represión del fraude organiza un Taller de Competencia sobre el tema de “Transporte y Competencia.”

La Direction générale de la concurrance, de la consommation, et de la repression des fraudes (DGCCRF - Directiva general francesa para la competencia, asuntos del consumidor y la represión del fraude) organizó un  Taller de Competencia sobre “Transporte y Competencia” que se llevó a cabo en el Ministerio de Economía, Finanza e Industria en Paris el 16 de diciembre del 2010. Estos talleres, que son de una duración de medio día, han sido organizados por el DGCCRF en múltiples ocasiones a lo largo del año sobre varios temas desde 1994. Este evento fue dirigido por Anne Wachsmann, una abogada de Linklaters, Cristophe Lemaire, un profesor asistente en la Universidad Sorbonne, y un abogado proveniente de Ashurst.  

Other translations forthcoming.