In principle it must be done as many statements for different purposes

Companies who operate an active Internet site that is offering goods or services online at Internet users generally constitute a database of the coordinates of the latter, be they customers or prospects, and can be communicated to partners sites. Until now, most marketers reported their site at the National Commission for computing and liberties (CNIL) by using the specific form available since 1997. This procedure, particularly simple to make, had met some success since nearly 75,000 sites had thus been declared. The CNIL abolished beginning July this obligation that this vector collection and dissemination is was undercover and was now taken into account in all of the simplified standards taken by the CNIL. So far, the Internet site statements were not sufficient to allow the merchant sites to meet reporting obligations of the law Informatique et Libertés. Indeed, any processing of personal data (to identify a natural person directly or indirectly) must be the subject of a statement on the use of the file, i.e. its "purpose" (personnel management or the management of access controls are examples of "purposes"). In principle, it must be done as many statements for different purposes. If the same data are used in a customer database but also to political marketing purposes, both statements must be made to the CNIL.

The sanctions are important. The fact, including negligence, to proceed or to conduct treatment automated of personal data without that have been complied with the formalities for their implementation, is punished by five years in prison and 1,500,000 euros fine for a corporation, the CNIL which can also take a decision to suspend processing and penalties.

The recently deleted the website statement had therefore no purpose or effect of cover the use of databases for commercial purposes. Due to a merchant site not made the statements of his client files outlined it above sanctions, even in the hypothesis where the Web site had been declared. The deletion of the statement of the website throws any ambiguity, it will not be possible for sites merchant to argue their good faith evoking the Declaration of their site, especially when they market data of Internet users who visit their site to business partners.

An ambiguous reference

Moreover, and for the record, merchant sites must also in the latter case clearly inform the people concerned both the rights that reserve them the law computer and freedoms (right of access, opposition, correction of their data) as recipients of such data. Too often the information given to users on the use of their data is too vague, the user can legitimately think that his personal data are communicated, where appropriate, as partners in the same area of activity than the popular site, while the spectrum of the partners involved may be much broader. Thus, a site dedicated to real estate price comparison may have contracts with advertisers interested by the population of landowners, may include institutions providing financial services, will think or any type of advertiser interested in this solvent deemed population then the surfer to artist that the partners of the site is limited, for example, real estate agencies. The only reference "partners" of the concerned site is often variable geometry and therefore ambiguous.

When the information is not sufficiently precise, the merchant is subject to the above sanctions. In addition, if on the basis of incomplete information, the person concerned has given his consent solicitations commercial (opt-in procedure) operations, controller is subject to the payment of fines in the amount of 750 euros per offence (commercial solicitation sent to a user which the value of prior consent will be challenged as insufficiently informed).

In these circumstances, it is strongly recommended to companies whose economic model is based on the exploitation of files fed to personal information collected on the Internet to ensure that statements made to the CNIL and the information communicated to its customers/prospects are sufficient.