By 31 March 2021 at the latest, all data read and/or write operations on user equipment must comply with the applicable legislative rules.

The CNIL's decision of 17 September 2020 reiterates these points: 

• cookies may not be placed without the prior consent of the user (the person concerned),

• clear and complete prior information to the user on the purpose of each cookie,

• The user may object to this.

In practice, the "cookies" banner should give the user three options: "accept all", "refuse all" or "configure" acceptance or refusal for each cookie, together with its purpose and retention period.

The CNIL did not wait for this date to strike and had already heavily fined Google LLC and Google Ireland Limited a record €100 million (see our news item of 14 December 2020 on our website: poggi-avocats.com).

As this decision was accompanied by a very high penalty for each day of delay, the Google companies asked the interim relief judge of the Conseil d'Etat to suspend its enforcement on the grounds that :

• The CNIL did not have the power to issue such an injunction, this power being vested in the supervisory authority of the principal place of processing under the "one-stop shop" mechanism provided for in Article 56 of the RGPD, i.e. the Irish supervisory authority,

• The amount of the penalty was too high, i.e. 100,000 euros per day of delay,

• The deadline for compliance was too short, i.e. 7 March 2021.

In its decision of 4 March 2021, the Conseil d'Etat rejected this request for three reasons:

• The "one-stop shop" mechanism provided for in the RGPD does not apply to cookies. Article 15a of the ePrivacy Directive sets out the jurisdiction of the Member States' supervisory authorities,
• Articles 16 and 20 of the LIL authorise the Cnil's restricted committee to impose any penalties for failure to comply with the obligations arising from the RGPD and the LIL, including a penalty payment of up to €100,000 per day of delay from the date set,
• The 3-month deadline is "reasonable, given the technical resources available to the Google companies and the adaptability they claim.

The legal arsenal is in place for the CNIL to strike fast and hard.