Social chamber : IP addresses and log files of the employee, before the GDPR

Only the french version is authentic

Summary

Pursuant to Articles 2 and 22 of Act No 78-17 of 6 January 1978, as amended by Act No 2004-801 of 6 August 2004, in its version prior to the entry into force of the General Data Protection Regulation (GDPR), IP addresses, which make it possible to indirectly identify a natural person, are personal data, within the meaning of the aforementioned Article 2, so that their collection by the exploitation of the log file constitutes a processing of personal data and must be the subject of a prior declaration to the National commission on information systems and freedom (Commission nationale de l’informatique et des libertés, CNIL) in application of Article 23 of the aforementioned law.

Pursuant to Articles 6 and 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms, the unlawfulness of a means of proof, with regard to the provisions of Act No 78-17 of 6 January 1978 as amended by Act No 2004-801 of 6 August 2004, in its version prior to the entry into force of the General Data Protection Regulation (GDPR), does not necessarily lead to its rejection from arguments, the judge having to assess whether the use of this evidence has undermined the fairness of the proceedings as a whole, by balancing the right to respect for the employee’s privacy against the right to evidence, which may justify the production of elements that infringe an employee’s privacy, provided that such production is indispensable to the exercise of this right and that the infringement is strictly proportionate to the objective pursued.

Encourages the quashing of the ruling which states that log files and IP addresses are not subject to a declaration to the CNIL, nor should they be subject to informing the employee in their capacity as a data protection officer when they are not primarily intended to monitor users, whereas the collection of IP addresses through the exploitation of the log file constitutes processing of personal data within the meaning of Article 2 of the aforementioned Act of 6 January 1978 and is subject to the formalities prior to the implementation of such processing provided for in Chapter IV of the said Act, which it follows that the proof was unlawful and the provisions of Articles 6 and 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms can be invoked.

Appellant(s) : Mr A... X...

Respondent(s) : Agence France Presse, autonomous entity

Facts and Procedure

1. According to the ruling under appeal (Paris, 16 March 2017), Mr X..., hired by Agence France Presse (AFP) on 9 September 1991, brought various claims for payment before the labour court on 17 February 2012. He was laid off on 27 February 2015 and was dismissed for serious misconduct on 23 March 2015, on the grounds of theft of computer data.

Reviewing pleas

On the first plea of the employee’s main appeal and the three pleas of the employer’s cross-appeal, appended hereafter

2. Pursuant to Article 1014, Section 2, of the Civil Procedure Code, there is no need to rule by a specially reasoned decision on these pleas, which are clearly not of a nature to lead to the quashing of the ruling.

On the first part of the second plea of the employee’s main appeal

Statement of plea

3. The employee objects to the ruling finding his dismissal justified by serious misconduct and rejecting his main request for reinstatement and his subsidiary requests for compensation in lieu of notice and related paid leave, severance pay and damages for dismissal without real and serious cause, whereas “under the terms of Article 32 of AFP’s internal regulations, no sanction other than a simple warning will be notified without prior notice to the staff representatives of the category of the employee concerned. The purpose of the prior nature of the information is to offer the employee additional protection through the assistance or intervention of staff representatives, which can only have a useful effect if the information is given in sufficient time to make the assistance effective. The cour d’appel (Court of Appeal) noted that the employee representatives had been notified on 23 March 2015 at 7:38 pm of a dismissal by letter that occurred on 23 March 2015 and notified at the earliest on 24 March 2015, within a period of time that allowed them to modify their position. In ruling in this way, when it was not disputed by AFP that the letter of dismissal had been sent on 23 March 2015, for an initial presentation on 24 March 2015, so that the information given to the staff representatives after the letter of dismissal had been sent did not allow the employee to be usefully assisted to enable the employer to reverse its decision if necessary, the cour d’appel (Court of Appeal) violated Article 32 of AFP’s internal regulations, together with Article L. 1232 1 of the Labour Code.”

Court’s response

4. The cour d’appel (Court of Appeal), which noted, on the one hand, that Article 32 of the company’s internal regulations provides that no sanction other than a simple warning shall be notified without first notifying the employee representatives of the category of the person concerned and, on the other hand, noted that the notice to the employee representatives was given on 23 March 2015 and that the notice of dismissal, within the meaning of the applicable contractual provisions, was given on 24 March 2015, rightly inferred that the employer had complied with the aforementioned Article 32. 5. The plea is therefore unfounded.

On the second part of the second plea of the employee’s main appeal

Statement of plea

6. The employee made the same objections to the ruling, whereas “ under the terms of Article 51 of the AFP company agreement of 29 October 1976, individual conflicts will be submitted to the joint committee for amicable settlement. It follows that this text institutes a special compulsory procedure for finding an amicable solution. By ruling that in the event of dismissal, the employer was not obliged to refer the matter to the joint committee beforehand, but that it was up to the most diligent party to do so, the cour d’appel (Court of Appeal) violated Article 51 of the AFP company agreement of 29 October 1976, and Article L. 1232-1 of the Labour Code.”

Court’s response

7. According to Article 51 of the AFP company agreement of 29 October 1976, individual conflicts will be submitted to a joint committee for amicable settlement, with a conciliatory mission only. If one of the parties challenges this committee, or if the attempt at conciliation fails, the interested parties may always bring the dispute before any French court having jurisdiction in the matter. Recourse to the joint committee for amicable settlement shall be notified by the most diligent party to the other party by letter setting out the point or points in dispute.

8. The cour d’appel (Court of Appeal) deduced exactly from this that the employer was not obliged to refer the matter to the joint committee for amicable settlement prior to the dismissal.

9. The plea is therefore unfounded.

But on the fourth part of the second plea of the employee’s main appeal

Statement of plea

10. The employee objects to the ruling finding that his dismissal was justified by serious misconduct and rejecting his main request for reinstatement and his subsidiary requests for compensation in lieu of notice and related paid leave, severance pay and damages for dismissal without real and serious cause, whereas “dismissal for serious misconduct, the proof of which is the responsibility of the employer, cannot be justified by evidence that is obtained unlawfully and that is therefore inadmissible. An illicit means of proof is the information collected, before any declaration to the CNIL, by an automated personal data processing system such as the collection of IP addresses, allowing the indirect identification of a natural person or the tracing of log files. The cour d’appel (Court of Appeal) held that the logs, log files and IP addresses, which constituted a computer trace, were not subject to a declaration to the CNIL, nor subject to informing the employee, since their primary purpose was not to monitor users.

By ruling in this way, for an irrelevant reason, when only the condition of the possible identification of a natural person was decisive, the cour d’appel (Court of Appeal) violated Article 2 and Article 22 of Act No 78-17 of 6 January 1978 relating to information systems, files and freedoms, together with Article L. 1234-1, Article L. 1234-5 and Article L. 1234-9 of the Labour Code, Article 9 of the Civil Procedure Code and Article 6 § 1 of the Convention for the Protection of Human Rights and Fundamental Freedoms.”

Court’s response

In view of Article 2 and Article 22 of Act No 78-17 of 6 January 1978 as amended by Act No 2004-801 of 6 August 2004, in its version prior to the entry into force of the General Data Protection Regulation, and Articles 6 and 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms :

11. IP addresses, which make it possible to indirectly identify a natural person, are personal data, within the meaning of Article 2 of Act No 78-17 of 6 January 1978 relating to information systems, files and freedoms, so that their collection by the exploitation of the log file constitutes processing of data of a personal nature and must be the subject of a prior declaration to the National commission on information systems and freedom (Commission nationale de l’informatique et des libertés, CNIL) pursuant to Article 23 of the aforementioned law.

12. However, as the Court has already ruled (Labour Chamber, 9 November 2016, appeal no 15-10.203, Bull. 2016, V, no 209), the right to evidence may justify the production of elements infringing on the privacy of an employee provided that such production is necessary for the exercise of this right and that the infringement is proportionate to the objective pursued. Similarly, it has already ruled (Labour Chamber, 31 March 2015, appeal no 13-24.410, Bull. 2015, V, no 68), that an employee may only appropriate documents belonging to the company if they are strictly necessary for the exercise of their rights of defence in a dispute between them and their employer, which it is up to the employee to demonstrate.

13. It also follows from the case law of the European Court of Human Rights, with particular reference to the surveillance of employees in the workplace, that it has held that Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms leaves it to the discretion of States to decide whether or not to adopt specific legislation concerning the surveillance of employees’ correspondence and non-professional communications (ECHR, Barbulescu, 5 Sept. 2017, no 61496/08, (§ 119). It recalled that, regardless of the latitude enjoyed by States in the choice of means to protect the rights in question, national courts must ensure that the implementation by an employer of surveillance measures infringing on the right to privacy or correspondence of employees is proportionate and is accompanied by adequate and sufficient safeguards against abuse (Barbulescu, supra, (§ 120).

14. The European Court of Human Rights has also ruled that, in determining whether the use as evidence of information obtained in disregard of Article 8 or in violation of domestic law has deprived the trial of the fairness required by Article 6, it is necessary to take into account all the circumstances of the case, in particular whether the rights of the defence have been respected, and the quality and significance of the evidence in question (ECHR, 17 Oct. 2019, Lopez Ribalda, no 1874/13 and 8567/13, (§ 151).

15. Finally, under Article 13. 1 g) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, applicable at the time of the acts concerned, Member States may take legislative measures to restrict the scope of the obligations and rights provided for in Article 6, paragraph 1, Article 10, Article 11, paragraph 1, Article 12 and Article 21 where such restriction constitutes a necessary measure to safeguard the protection of the data subject or of the rights and freedoms of others.

16. It is therefore now necessary to rule that the unlawfulness of a means of proof, with regard to the provisions of Act No 78-17 of 6 January 1978, as amended by Act No 2004-801 of 6 August 2004, in its version prior to the entry into force of the General Data Protection Regulation, does not necessarily lead to its rejection from arguments. The judge must assess whether the use of this evidence has undermined the fairness of the proceedings as a whole, balancing the right to respect for the employee’s privacy against the right to evidence. This may justify the production of elements that infringe on an employee’s personal privacy, provided that such production is indispensable to the exercise of this right and that the infringement is strictly proportionate to the objective pursued.

17. In order to judge dismissal based on serious misconduct and to dismiss the employee’s main request for reinstatement and his subsidiary requests for compensation in lieu of notice and related paid leave, severance pay and damages for dismissal without real and serious cause, the ruling holds that according to a bailiff’s report, cross-checking the log file information extracted from data from AFP’s centralised log manager for the day of 30 January 2015 and the time slot from 12:02 am to 4:02 pm and the address used to send the incriminated messages, it was found that the IP address used was that of Mr X.... It also states that logs, log files and IP addresses, which constitute a computer trace that cannot be ignored by the employee in view of their duties, are not subject to declaration to the CNIL, nor must they be subject to informing the employee in their capacity as a data protection officer, when they are not primarily intended to monitor users. It adds that only the implementation of software for analysing the various logs (applications and systems) that allows the collection of individual information item by item to monitor user activity must be declared to the CNIL, as it is an automated processing of nominative information. The ruling concludes that since it does not concern the implementation of such software, but rather a simple tracing from log files, for which AFP’s current IT and internet resources charter specifies that they are kept by the administrator for a period of up to six months, the evidence against the employee is legal and does not result from unfair performance of the contract.

18. In so ruling, the cour d’appel (Court of Appeal) violated the aforementioned texts, whereas the use of log files, which make it possible to indirectly identify a natural person, constitutes processing of personal data within the meaning of Article 2 of the aforementioned Act of 6 January 1978, and was thus subject to the formalities prior to the implementation of such processing provided for in Chapter IV of the said Act, from which it resulted that the evidence was unlawful and, consequently, the requirements set out in paragraph 16 of this ruling could be invoked.

ON THESE GROUNDS, and without it being necessary to rule on the other objections, the Court  :

DISMISSES the cross-appeal filed by Agence France Presse ;

QUASHES AND SETS ASIDE the ruling rendered on 16 March 2017, between the parties, by the cour d’appel of Paris (Paris Court of Appeal), but only in so far as the ruling finds the dismissal of Mr X... based on serious misconduct and consequently rejects his principal claim for reinstatement and his subsidiary claims for compensation in lieu of notice and related paid leave, severance pay and damages for dismissal, without real and serious cause ;

Returns, on these points, the case and the parties to the status existing prior to the said ruling and refers them to the cour d’appel of Paris (Paris Court of Appeal) otherwise composed ;