<!-- wp:paragraph -->
<p>Une amende, not an almond, but a fine for cookies. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The French DPA <a href="https://www.cnil.fr/fr/sanctions-2250000-euros-et-800000-euros-pour-carrefour-france-carrefour-banque">CNIL finally </a><a href="https://www.cnil.fr/fr/sanctions-2250000-euros-et-800000-euros-pour-carrefour-france-carrefour-banque" target="_blank" rel="noreferrer noopener">enforced the</a><a href="https://www.cnil.fr/fr/sanctions-2250000-euros-et-800000-euros-pour-carrefour-france-carrefour-banque"> law</a>, Carrefour supermarket and Carrefour Bank fined for 2 250 000 euros and 800 000 euros.<br>- lack of transparency (article 13 GDPR)<br>- unlawful cookies (article 82 de la loi Informatique et Libertés)<br>- storage limitation, article 5.1.e GDPR<br>- lack of mention of data subjects rights, article 12 GDPR<br>- infringement of articles 15, 17 et 21 du RGPD et L34-5 Code des postes et des communications électroniques<br>- unlawful and unfair data processing, article 5 GDPR. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Here is the new Carrefour's website cookie situation with a <a href="https://static.carrefour.fr/static/cfr/C4FR/2020/rgpd/tableau-cookies-rgpd-2020_v5.pdf">link</a> to what looks to be full transparency on third parties. Remains the question of the data transfer outside the eeA, Google Analytics and Facebook Connect have been sued by NOYB NGO since the invalidation of the Privacy shield by the ECJ decision SchremsII v Facebook July 2020.</p>
<!-- /wp:paragraph -->

<!-- wp:coblocks/gallery-carousel -->
<div class="wp-block-coblocks-gallery-carousel"><div class="is-cropped coblocks-gallery has-no-alignment has-caption-style-dark has-horizontal-gutter"><div class="has-carousel has-carousel-lrg" style="height:400px" data-flickity="{&quot;autoPlay&quot;:false,&quot;draggable&quot;:true,&quot;pageDots&quot;:false,&quot;prevNextButtons&quot;:true,&quot;wrapAround&quot;:true,&quot;cellAlign&quot;:&quot;center&quot;,&quot;pauseAutoPlayOnHover&quot;:false,&quot;freeScroll&quot;:false,&quot;arrowShape&quot;:{&quot;x0&quot;:10,&quot;x1&quot;:60,&quot;y1&quot;:50,&quot;x2&quot;:65,&quot;y2&quot;:45,&quot;x3&quot;:20},&quot;thumbnails&quot;:false,&quot;responsiveHeight&quot;:false}"><div class="coblocks-gallery--item"><figure class="coblocks-gallery--figure has-margin-left-5 has-margin-left-mobile-5 has-margin-right-5 has-margin-right-mobile-5"><img src="https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-09.45.29-1-1024x532.png" alt="" data-id="1735" data-link="https://www.datarainbow.eu/french-dpa-cnil-fined-carrefour-for-cookies/screenshot-2020-11-26-at-09-45-29-1/" class="wp-image-1735"/></figure></div></div></div></div>
<!-- /wp:coblocks/gallery-carousel -->

<!-- wp:paragraph -->
<p>Time for the many websites with unlawful cookies to check their compliance. Consent is required before any cookies are placed, transparency and - as NOYB NGO has already filed - expect Google Analytics and Facebook Connect transferring data to the US to be infringing the GDPR. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://lnkd.in/egAkGxw">CNIL's decision against </a><a href="https://lnkd.in/egAkGxw" target="_blank" rel="noreferrer noopener">Carrefour</a><a href="https://lnkd.in/egAkGxw"> France.</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://lnkd.in/ePd4-yM">CNIL's </a><a href="https://lnkd.in/ePd4-yM" target="_blank" rel="noreferrer noopener">decision</a><a href="https://lnkd.in/ePd4-yM"> against </a><a rel="noreferrer noopener" href="https://lnkd.in/ePd4-yM" target="_blank">Carrefour Banque</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://lnkd.in/eNqZK-j">CNIL's press release.</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>CNIL's recommendations of October 1st 2020 on the use of cookies. <a href="https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience">"Cookies : solutions pour les outils de </a><a rel="noreferrer noopener" href="https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience" target="_blank">mesure</a><a href="https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience"> d'audience</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://noyb.eu/en/101-complaints-eu-us-transfers-filed">https://noyb.eu/en/101-complaints-eu-us-transfers-filed</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Max Schrem's 'Non of Your Buisness' NOYB has filed a complaint against 101 companies</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p><strong>A quick analysis of the HTML source code of major EU webpages shows that many companies still use Google Analytics or Facebook Connect one month after a major judgment by the Court of Justice of the European Union (CJEU) - despite both companies clearly falling under US surveillance laws, such as FISA 702. Neither Facebook nor Google seem to have a legal basis for the data transfers. Google still claims to rely on the “Privacy Shield” a month after it was invalidated, while Facebook continues to use the "SCCs", despite the Court finding that US surveillance laws violate the essence of EU fundamental rights.</strong></p></blockquote>
<!-- /wp:quote -->

<!-- wp:list -->
<ul><li><strong><a href="https://noyb.eu/en/eu-us-transfers-complaint-overview">Link to the list of all 101&nbsp;<em>noyb</em>&nbsp;complaints and companies</a></strong></li><li><strong><a href="https://support.google.com/analytics/answer/6004245?hl=en&amp;ref_topic=2919631">Google’s information claiming to "move" to Standard Contractual Clauses</a></strong></li><li><strong><a href="https://www.facebook.com/help/566994660333381?ref=dp">Facebook’s claim to still use Standard Contractual Clauses</a></strong></li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Nataliia Bielova PhD, a researcher at INRIA, who has done an extensive research on cookies with her colleagues, said :</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>CARREFOUR is also fined for Google Analytics cookies being used together with Google Ads. In our recent work, we've shown that on 38% of websites Google Analytics synchronizes cookies with Google Ads (<a rel="noreferrer noopener" target="_blank" href="http://doubleclick.net/">http://doubleclick.net</a>). Happy to see this sanction that brings this practice to the eyes of the public! Link to our academic peer-reviewed paper: <a rel="noreferrer noopener" target="_blank" href="https://hal.inria.fr/hal-01943496">https://hal.inria.fr/hal-01943496</a></p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>Together with her colleagues at Inria, they have designed a Massive Open Online Course (MOOC) entitled “<em><a href="https://www.fun-mooc.fr/courses/course-v1:inria+41015+session04/about" target="_blank" rel="noreferrer noopener">Protection de la vie privée dans le monde numérique</a></em>”. From 2018 till May 2020, the MOOC has been open for 4 sessions and attracted in total over 43,000 French-speaking participants from all over the world. Link to the latest session: </p>
<!-- /wp:paragraph -->