French Legal Problems for Facebook

France's data protection authority the CNIL has given Facebook three months to stop tracking non-users' web activity without their consent, and says the company must stop certain transfers of personal data to the USA.

According to Reuters, the French order is the first significant action against a company to result from the EU's autumn abrogation of the Safe Harbour agreement and its proposed replacement with more stringent Shield legislation.

The CNIL said in a statement: 'Facebook transfers personal data to the United States on the basis of Safe Harbour, although the Court of Justice of the European Union declared invalid such transfers in its ruling of October 6, 2015'. Facebook says it does not rely on Safe Harbour but has its own protocols for transfers which it is confident comply with the relevant legislation, adding: 'Protecting the privacy of the people who use Facebook is at the heart of everything we do. We ... look forward to engaging with the CNIL to respond to their concerns'.

The CNIL has also said that Facebook's placing of a cookie on non-users' browsers without informing them does not comply with French privacy law; and that users should be able to opt out of being profiled for ad personalization purposes.

Facebook has already faced a legal challenge in Belgium over its practices and faces investigations also in Spain, Germany and The Netherlands. In France, the company faces a fine if it does not comply within three months - which seems like a long time and potentially a whole lot of data...