French so-called “amicable procedures” are widely used to rescue companies facing difficulties due to the “Covid” crisis.
Our restructuring partner explains the benefits of this procedures for companies. Here is a brief explanatory video.
If you have any questions regarding “amicable procedures” or restructuring in France, please feel free to contact Gilles Podeur or Nicola Kömpf (for German-speaking clients).
Foreign companies are increasingly sanctionned by the French Data Protection Authority (CNIL). Our team is presenting the main risks for foreign companies regarding cookies and data privacy. Here is a brief explanatory video.
If you have any questions regarding cookies and data privacy issues in France, please feel free to contact Corinne Thiérache.
March 31, 2021: deadline to comply with the new rules on cookies
As a reminder, the reasonable timeframe granted by the French Data Protection Authority (also knows as the “CNIL”) to bring your websites and mobile applications into compliance with the new rules on cookies and other trackers contained in its guidelines and recommendation published on October 1, 2020 expires on March 31, 2021 at night.
Considering this timetable, the CNIL has indicated that formal controls will be carried out as of April 2021 and that it will not hesitate to impose sanctions in case of non-compliance.
Economic players are therefore strongly advised to conduct an audit of the cookies and trackers used in order to, if necessary, take the necessary measures to meet with the requirements of the legislation.
For the record, certain cookies are exempt from the requirement of obtaining consent, such as functional cookies and various audience measurement cookies, if they fulfill the conditions recently recalled by the CNIL on March 8, 2021.
For cookies requiring consent, particularly those used for targeted marketing, the following principles must be followed:
• Principle 1: the mere continuation of navigation on a website can no longer be considered a valid expression of user consent.
• Principle 2: individuals must consent to the deposit of trackers by a clear positive act (such as clicking on “I agree”). If they do not do so, no tracker that is not essential to the operation of the service may be deposited on their device.
• Principle 3: users should be able to withdraw their consent easily and at any time.
• Principle 4: refusing cookies should be as easy as accepting them.
• Principle 5: data subjects must be clearly informed of the purposes of the trackers before consenting, and of the consequences of accepting or refusing trackers.
• Principle 6: data subjects should also be informed of the identity of all actors using trackers (including third-party cookies) that are subject to consent.
• Principle 7: entities using trackers must be able to provide, at any time, proof of the valid collection of the freely given, informed, specific and unambiguous consent of the user.
These principles must be strictly complied with by the economic players, as the financial penalties for non-compliance can be particularly heavy.
Thus, on December 7, 2020, the CNIL fined Amazon and Google 35 million and 100 million euros respectively for failing to comply with their obligations to obtain consent and provide information prior to the deposit of advertising cookies. Despite an appeal filed by Google before the Council of State, the latter validated the legality of the CNIL’s decision on March 4, 2021 hence reinforcing its sanctioning power.
Notification of a personal data breach
The fire at OVH’s Strasbourg data center on March 10, 2021 and its potential consequences on personal data (loss, damage) are an opportunity to remind the obligations set by the General Data Protection Regulation (GDPR) in this kind of situation, which requires data controllers, among other obligations, to:
• notify without undue delay and, where feasible, not later than 72 hours after having become aware of it, the personal data breach likely to result in a risk to the rights and freedoms of natural persons to the CNIL (Article 33) and, when the risk is high, directly to the data subjects concerned (Article 34),
• document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.
As for the processor, it shall notify the controller without undue delay after becoming aware of a personal data breach.
The situation will therefore differ according to the role of each party in the processing of personal data (controller, processor or joint controller). For instance, contracts with processors generally contain provisions on incident and personal data management that address this issue in practice.
When breaches of the GDPR or the law are brought to its attention, the CNIL’s restricted committee may:
• issue a reprimand;
• enforce the processing to comply, including under penalty;
• temporarily or permanently restrict a processing operation;
• suspend data flows;
• issue an order to comply with requests to exercise the rights of individuals, including under penalty;
• impose an administrative fine.
In case of non-compliance with the obligation to notify, the CNIL’s restricted committee may impose administrative fines on the controller and/or processor up to 10 million euros or, in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
The lawyers of Alerion’s Data Privacy department can assist their clients in complying with their obligations under the RGPD, especially with the regulation on cookies and other trackers before next April 1st.
Corinne Thiérache, Partner and Alice Marie, Associate in Digital and Technology Law.
On 13 January 2021, the court of appeal of Toulouse rendered a very interesting decision ruling upon the outcome of the insolvency proceedings of BVA, a well-known research and consulting firm.
Context – The specific feature of this insolvency case was the fierce competition to take over the company’s assets (together with the assets of three other entities of the group) between the bidders: (i) Alcentra, a major creditor of the group (having granted an EUR 140 000 0000 unitranche financing in 2017), whose bid had been chosen by the court of first instance and (ii) the existing managers and key shareholders of the group, who had set up their own takeover bid through of special purpose vehicle named XPage, and whose bid ultimately prevailed before the court of appeal.
• On the one hand, it is quite unusual to see creditors bid for assets in insolvency proceedings, all the more as they are not allowed to offset the price they offer for the assets with the amount of their claims against the company. Lender-led transactions are more frequent at an earlier stage of the financial difficulties, where creditors take control of the debtor entity through a debt-to-equity swap.
• But on the other hand, it is equally unusual to see managers being allowed to bid for the company’s assets. The French commercial code expressly prohibits managers to participate in the bid process, unless they obtain a specific authorization from the court, which can be granted only in the event that the public prosecutor so requests (this rule was temporarily amended during the COVID crisis, until 31 December 2020, so that the managers themselves or the insolvency administrator were also entitled to make such request).
First instance ruling – In a judgment dated 15 September 2020, the commercial court of Toulouse had chosen Alcentra’s bid. It is worth noting that in the course of the insolvency proceedings, in July 2020, Alcentra had already taken control over some US assets of the group, through a security enforcement.
• In a “normal” case, things would have stopped there. The right of appeal against a decision selecting a bidder in insolvency proceedings is very restricted by law and must be exercised within ten days from the decision. Unfortunate bidders, such as XPage in this case, are barred from raising an appeal.
Appeal by the public prosecutor – But the public prosecutor decided otherwise and did file an appeal against the commercial court’s decision – which is highly uncommon.
• The fact that the appeal was made by the public prosecutor is absolutely key here, because an appeal by another party would not have stayed the enforcement of the judgement, and Alcentra would have immediately taken control over the business, until the court of appeal’s decision.
Appeal by the debtor – BVA also filed an appeal.
• Interestingly, the public prosecutor’s appeal ended up being rejected on procedural grounds (the public prosecutor having made a procedural mistake), but the court of appeal nevertheless remained in position to rule on the case because of the appeal filed by BVA itself.
Appeal ruling – The court of appeal of Toulouse overturned the judgment of first instance and chose XPage’s bid, on the grounds that (i) it was widely supported by the employees of the group, and that (ii) the governance to be put in place by Alcentra was potentially detrimental to the French rooting of the group and the preservation of jobs in France. The court also took the view that XPage’s bid was superior to that of Alcentra in terms of sale price.
• Aside from the purely legal aspects of the case, this decision is also another example of a current trend of French public authorities’ interventionism in situations where the acquisition of significant French business is contemplated by foreign investors, especially in a context where they are weakened by the COVID crisis.
Gilles Podeur, Partner, Louis Renucci, Associate, and Yann Aubert, Trainee in Restructuring and Insolvency.
The interest of producers and manufacturers for the “Made in France” label is renewed, in this pandemic period where consumers’ sensibility is exacerbated.
The French economic administration has just published a guide on the essential rules (available here), so that the “Made in France” is not considered as deceptive marketing practice (art. L 121-1 et seq. of the French Consumer Code) or as deception on origin (art. L. 413-8 of the French Consumer Code), nor prohibited by customs provisions as being a fraudulent origin marking on import (art. 39 of the French Customs Code).
For non-food products, companies are invited to refer to the European regulations about non-preferential customs origin in order to identify the “nationality” of the product concerned. When several countries are involved in the manufacturing process, the product originates from the country where the last substantial transformation (1), economically justified (2), carried out in a company equipped for this purpose and having resulted in the manufacture of a new product or corresponding to an important manufacturing stage (3) took place (circular of May 13, 2016). In other words, a non-food product can benefit from a “Made in France” label or its equivalent, if its last substantial transformation was carried out in France. Depending on the category of products concerned, the notion of “last substantial transformation” means a specific transformation (working for textiles), a change in the price heading of the product or a value-added criterion.
The manufacturer is free to put “French manufacture” or an equivalent on its products. This kind of mention differs from labels and collective marks such as “Origine France Garantie”, created by professionals or private structures and whose function is to identify the origin of products emanating from a group of actors (association, group of manufacturers, producers or merchants, legal entity of public law) authorized to use it by a regulation of use.
Controls are carried out by the French economic administration (Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes, DGCCRF) and the French customs administration (Direction Générale des Douanes et des Droits Indirects, DGDDI).
In addition to criminal sanctions, the wrong use of “Made in France” may have serious consequences under tort, if a competitor brings an action for unfair competition on this basis.
Indeed, for the first time this year, the Cour de Cassation has ruled that the damage caused by a misleading practice can be compensated by taking into account, not only the loss of profit or losses suffered by the (unfortunate) competitor, but the savings made by the unfair competitor (Cass. com. 12 Feb. 2020, n°17-31614).
In this case, a French factory of crystal goods sued a competitor for having presented products consisting of glass, crystalline or luxion products made in China with a “Made in France” label, to give the impression that the entire product was made of crystal. Held responsible for unfair competition through a deceptive commercial practice, the competitor was ordered to pay compensation calculated in consideration of the undue competitive advantage and the unfair savings (with reference to its personnel expenses). The Cour de cassation approved the reasoning of the first judges, which departs from the traditional analysis of unfair competition consisting in the assessment of the damage to be repaired by lost profits, lower sales, reduced sales, orders, loss of margin, loss of value, etc.
The solution deserves approval insofar as negative consequences of acts of unfair competition such as free-riding or failure to comply with mandatory regulations are difficult to quantify.
Thus, the Cour de cassation agrees to take into consideration the savings of the unfair competitor obtained by taking advantage of a competitive advantage to which it is not entitled. This method already exists for counterfeiting litigation, which already takes into consideration the savings made by the counterfeiter on design and promotion costs (art. L. 716-4-10 of the French Intellectual Property Code, introduced in 2019).
The action in unfair competition thus finds an attractive power already initiated by the jurisprudence according to which a prejudice is necessarily inferred from the unfair act. There is now an adequate method of evaluation of the damage which will not only compensate the victim but also discourage unfair acts.
Catherine Robin, Partner in charge of the Distribution Department and Ambre Luciak, legal counsel.
In recent years, France has steadily tightened up its legislation on the posting of workers to prevent undeclared work and social dumping.
The latest legislation entered into force on 30 July 2020.
The posting of workers to France therefore represents a significant financial risk for foreign companies with temporary activities in France.
Even if the employment contract between the foreign company and the posted worker is subject to foreign law, the worker is subject to certain aspects of French law while working in France. New stricter rules have been in force since 30 July 2020.
In particular, a distinction is made between postings of more or less than 12 months.
Parts of French law are, according to Art. L.1262-2 of the French Labour Code, applicable to postings of less than 12 months, including in particular equal treatment in terms of remuneration (i.e. not only the minimum wage obligation (as of 01.01.2020 – 10.15 € gross/hour) but also equality must be guaranteed). Furthermore, the expenses incurred by the secondment must be remunerated separately.
These provisions represent the so-called “hard core” which must always be observed.
For postings for more than 12 months, all provisions of French labour law apply, except for the conclusion and termination of the employment contract, post-contractual non-competition clauses and supplementary pension schemes.
Where appropriate, the application of all French law may be suspended for a further 6 months on request before the end of the first 12 months if special circumstances arise.
In conclusion, the formalities for posting workers to France are and will remain strict, unless an exception applies, and the penalties are costly.
However, since most companies make use of the same type of posting repeatedly, it is generally sufficient to seek detailed advice once and then to carry out the measures on their own.
The same applies to the application of French labour law. One should always bear in mind that French law is structured differently from foreign legal systems and consequently make the right adjustments in advance to avoid difficulties and high costs afterwards.
Nicola Kömpf, Partner.
Unsurprisingly, France has massively promoted the recourse to state-guaranteed loans to help companies overcome the crisis. More than EUR 120 billion have already been borrowed through such loans (so-called “PGE” or prêts garantis par l’Etat). Their restructuring, together with that of more “traditional” debts, is expected to be a key topic for 2021.
In this context, exceptional measures aimed at protecting borrowers have also been adopted. Two of them are particularly worth being mentioned.
Firstly, it has now become easier for borrowers to request a court-imposed grace period against creditors refusing to participate in confidential debt restructuring negotiations under the aegis of a court-appointed “conciliator” (conciliateur). Traditionally, such restructuring discussions remain purely consensual, although a limited possibility to request, in summary proceedings, a two-year grace period against an uncooperative creditor has always existed. The new measures broaden the borrower’s options. There in now a possibility to request, ex parte, a prohibition for uncooperative creditors to enforce their rights during the time of the negotiations under the aegis of the conciliator. In addition, the conditions for the granting of the two-year grace period have been facilitated.
Secondly, the new measures encourage a rather radical debt restructuring process, namely the takeover of a company’s assets by its own managers or shareholders, in insolvency proceedings. Traditionally, de facto or de jure managers are barred from purchasing the company’s assets in insolvency proceedings, unless they obtain a specific authorization from the Court, and such authorization may only be granted upon petition of the public prosecutor. The exceptional measures allow the debtor itself (or the insolvency administrator) to request such authorization, if that is a way to preserve jobs. This derogatory measure has been applied in a number of recent significant insolvency proceedings, and indeed helped saving jobs. However, it is due to end on 31 December 2020.
Gilles Podeur, Partner and Julien Brouard, Trainee.
The second lockdown has forced the government to strengthen emergency and support measures for companies. These exceptional measures complement the specific sectoral and regional aid already put in place to deal with the economic slowdown of businesses, weakened by the pandemic’s first wave.
1. A widen Solidarity Fund
Businesses with less than 50 employees that are administratively closed due to lockdown will receive up to €10,000 per month in aid to make up for their loss of turnover. Depending on their sector of activity, businesses that remain open but suffering a loss of more than 50% of their turnover may also receive a State allocation between €1,500 and €10,000 per month.
2. Exemption and deferral of social security contributions
Companies with less than 50 employees that are administratively closed due to lockdown may benefit from (i) a total exemption of employers’ social security contributions and (ii) an aid for the payment of social security contributions of 20% of the total payroll. Other employers may request a payment deferment of their contributions for all November 2020 deadlines. Social contributions for the self-employed will not be collected for the month of November.
3. Tax credit for commercial landlords
In order to reduce rents, a tax credit for commercial landlords will be implemented for owners who waive the right to receive payment of rent for at least one month’s rent between October and December 2020. The reduction will represent 30% of the amount of rent waived.
4. The extension of the exceptional Partial Business Activity Regime
The furlough scheme has been extended until December 31, 2020. No remaining amount will be due by the employer of protected sectors (tourism, events, culture, sport) or those subject to administrative closures due to the lockdown. Employees will be paid 84% of their net salary.
5. Strengthening of State-guaranteed loans
The State-guaranteed loan regime is extended from December 31, 2020 to June 30, 2021. Amortization of said loans may be spread over up to 5 additional years, with rates for SMEs ranging from 1 to 2.5%. The State will also be able to grant direct loans to VSE/SMEs that have not been able to obtain a State-guaranteed loan.
Antoine Rousseau, Partner.
On September 17th, 2020, the French Data Protection Authority (also known as the “CNIL”) adopted two documents on cookies, namely guidelines (Deliberation No. 2020-091 of September 17th, 2020 adopting guidelines relating to the application of Article 82 of the Law of January 6th, 1978 as amended to reading and writing operations in a user’s terminal (in particular “cookies and other trackers”) and repealing Deliberation No. 2019-093 of July 4th, 2019) and a recommendation (Deliberation No. 2020-092 of September 17th, 2020 adopting a recommendation proposing practical methods for compliance in the event that “cookies and other trackers” are used).
Through these new deliberations published on October 1st, the French data protection authority (DPA) confirms certain major principles:
o Concerning user consent:
– The mere continuation of navigation on a website can no longer be considered as a valid expression of consent,
– Individuals must consent to the deposit of trackers by a clear positive act (click on “I accept” in a cookie banner, for example). If they do not do so, no tracker that is not essential to the operation of the service may be deposited on their device.
o Users must be able to withdraw their consent easily and at any time,
o Refusing trackers should be as easy as accepting them,
o Concerning the information of data subjects:
– They must be clearly informed of the purposes of the trackers before consenting, as well as the consequences of accepting or refusing trackers,
– They must also be informed of the identity of all actors using trackers subject to consent.
o Entities using trackers must be able to provide, at any time, proof of valid collection of the freely given, informed, specific and unambiguous consent of the user.
Regarding “cookie walls”, which consist of blocking access to a website if cookies are refused, the French DPA has prudently taken into account the decision of the “Conseil d’Etat” dated on June 19th, 2020. Thus, without directly recognising a lawfulness in principle of this practice, the French DPA considers that a case-by-case analysis will be necessary.
Nevertheless, certain trackers are exempt from the requirement of obtaining consent. This is notably the case for trackers intended for authentication with a service, those intended to store the contents of a shopping basket on an online shopping site, those intended to generate frequentation statistics, or those allowing paying websites to limit free access to a sample of content requested by users.
In addition, the French DPA makes several recommendations to the players concerned:
• Two buttons should be provided: “accept all” and “refuse all”,
• Websites, which usually retain consent to trackers for a certain period, should also retain the refusal of Internet users for a certain period. In this respect, the French DPA considers that it is good practice for website publishers to keep the choice (refusal or consent) for a period of 6 months,
• When the trackers allow tracking on other websites, consent must be obtained on each of the websites concerned by this navigation tracking.
The time allowed for the concerned actors to comply with the new rules must not exceed 6 months, i.e. by the end of March 2021 at the latest.
The French DPA will consider the operational difficulties of the economic players during this period and will give priority to support rather than control. However, it reserves the right to prosecute certain breaches, particularly in the event of a particularly serious breach of the right to privacy, and will continue to prosecute breaches of the rules on cookies prior to the entry into force of the GDPR (recommendation of December 5th, 2013).
As a reminder, this communication comes at a time when the e-Privacy Regulation, a specific regulation that has been postponed several times since 2016 and which will aim to apply the principles resulting from the GDPR to electronic communications, has still not been adopted by the European Commission.
The lawyers of Alerion’s Data Privacy and Digital and technology law departments assist the economic players who will have to embark on a new project to comply with the GDPR regarding cookies and other trackers.
Corinne Thiérache, Partner and Alice Marie, Legal Counsel.
With the help of Morgane Sapin, Student Lawyer at the ECOA.
These days, digitalization is essential for any company wishing to offer its products and/or services to the public. The current health crisis stimulates an increasing digitalization. However, it requires a legal support.
Rule # 1: You shall contractually supervise the IT developments of a third party
The use of an IT service provider for the digitalization of its products and services requires special attention on several points.
In particular, you shall:
Define specifications : It must specify the general context of the project of creation of the Internet site and/or the application as well as the technical specifications of the considered IT developments, in order to answer the exact needs of the customer;
Establish a schedule : Mandatory dates can be set, and their non-respect will be sanctioned by the application of financial penalties to the service provider ;
Set up a steering committee : Periodic validation of the services by the client allows the latter to check the conformity of the services with the specifications, and if necessary, to request corrections and report on the progress of the project;
Supervise the validation of the IT developments : The reception of a deliverable from the service provider, whether it is a hardware, a software solution or a study document, must be organized. The scope and breakdown of the acceptance, as well as the production of an acceptance report with potential reservations, must be specified;
Decide about the maintenance issue : A choice with different implications has to be made between maintenance carried out by the main service provider, a third party or your care ;
Pay attention to the limitation of liability clause : The IT service provider tries by this means to limit his responsibility by introducing a ceiling for compensation often equal to the amount of the sums paid by the customer. In this context, it is important to negotiate a liability arrangement that is proportionate to the economic data of the project in question. The clause must, however, represent sufficient financial pressure to induce the service provider to satisfy its customer ;
Include a confidentiality clause to protect your innovations : The scope of such a contractual clause is essential and must be negotiated, in particular what is covered by confidentiality, the duration of the clause. Moreover, this clause shall ensure that there is no breach of confidentiality in the event of subcontracting.
Rule # 2: You shall check the assignment of the intellectual property rights of the digitalization project to your benefit
An e-commerce website implies the registration of a domain name (or several), as well as the registration of an available trademark which geographical protection will depend on the nature of the project.
Whether you resort to a third party or to an employee to help you to digitize your activity and/or to create/improve your visual identity within the framework of this digitalization, it is advisable not to forget to make sure of the assignment to your benefit of the intellectual property rights protecting the resulting creations.
Contrary to preconceived ideas, the situations in French law in which the assignment of intellectual property rights is automatic without any formality are quite rare and in reality only concern software and collective works created within the framework of an employment contract. In most cases, it is necessary to expressly provide for the assignment of the property rights of the creations, which must comply with a strict formalism.
Rule # 3: You shall anticipate the personal data collection and the compliance of processing operations
The General Data Protection Regulation (GDPR) imposes numerous obligations on the website operator that collects and processes personal data via cookies and/or online forms.
In addition to keeping a register, the data controller will in particular have to provide certain information to the data subjects beforehand (purposes of the processing, legal bases, duration of data retention, identity of the data controller, rights of the persons whose data are collected, recipients of the data, transfer of the data outside the European Union, etc.). A privacy policy allows all of this information to be included in addition to the specific informative mentions appearing on data collection forms or in newsletters.
Rule # 4: You shall fulfil the e-commerce’s duties
E-commerce is governed by a certain number of restrictive rules that must be taken into account as soon as the design of sites or applications is completed (legal notices allowing the identification of the website operator, information specific to distance contracts, purchasing and browsing processes adapted to the delivery of this information, etc.).
Within the framework of relations between professionals and consumers (B to C), professionals must provide specific information, in particular regarding possible delivery restrictions, the conditions for implementing the right of withdrawal and the costs relating to the exercise of this right, which are most often set out in General Terms and Conditions of Sale.
Rule # 5: You shall preserve your e-reputation
It is recommended that you monitor the name of your company or site on search engines, especially Google. This monitoring allows you to stay informed of what is said about your company, your products, your services, your management style, or your customer service.
It is advisable that you respond quickly to negative reviews before they become problematic and too visible. Also, you should request the removal of false reviews that harm your e-reputation if you can do so.
The teams of the Intellectual Property, Digital and Technology Law, and Data Privacy departments are at your disposal to discuss your digitalization projects and provide useful advice at all stages and on all aspects of these projects.
Corinne Thiérache, Partner and Carole Bui, Attorneys at the Paris Bar.
Thanks to Morgane Sapin, Student lawyer.