REGISTRATION DOCUMENT AND FINANCIAL REPORT - Iliad

6. OVERVIEW OF THE GROUP’S BUSINESS
6.6 REGULATORY SITUATION
The Group makes access to Free’s no-subscription services conditional upon customers providing a physical
address to which their connection settings can be sent by post. Free is therefore in a position to respond to any
requests for information from the legal authorities. As the flat-rate and broadband services are linked to physical
access, Free is also able to respond to requests from the authorities concerning the subscribers of these services.
Processing of personal data and protection of individuals
Framework Directive 95/46/EC of October 24, 1995 relating to the protection of individuals with regard to the
processing of personal data and the free movement of such data specifies the requisite measures for effectively
protecting the rights and freedom of individuals. The main objectives of this Directive are to (i) harmonize
European legislation governing the processing of personal data, (ii) facilitate the movement of such data
(provided that the country of destination of the information concerned provides a satisfactory level of protection),
and (iii) ensure the protection of the rights and freedom of individuals. This Framework Directive was
supplemented by the sector-specific Directive 97/66/EC of December 15, 1997 relating to the processing of
personal data and the protection of privacy in the telecommunications sector. This Directive has been repealed
and replaced by Directive 2002/58/EC of July 12, 2002.
Law 2004-801 of August 6, 2004 on the protection of individuals with respect to the processing of personal data,
amending Law 78-17 of January 6, 1978 relating to information technology, computer files and civil liberties,
transposed the Framework Directive of October 24, 1995 and certain provisions of the Directive of July 12, 2002
into French law.
Law 2004-575 of June 21, 2004 on confidence in the digital economy and Law 2004-669 of July 9, 2004 on
electronic communications and audiovisual communication services also transposed certain provisions of the
Directive of July 12, 2002 into French law.
The main provisions of Law 2004-801 of August 6, 2004 are as follows:
• Article 7 establishes the principle that no personal data may be processed without the consent of the person
concerned. This Article does, however, set forth a limited number of circumstances in which such processing
may be lawful, even without the consent of the person concerned. This applies in particular if such
processing is necessary in the legitimate interests of the data processor or the recipient “provided that it does
not disregard the interests or infringe the fundamental rights and freedoms of the person concerned”. Such
exceptions do not, however, apply to the processing of “sensitive data”, for which Article 8 of Law 2004-801
requires the express consent of the person concerned.
• The data processor’s obligation to provide information covers all situations in which personal data is
processed, even if this data has not been collected directly from the person concerned, such as for file
transfers. In the latter case, Article 32-III of Law 2004-801 states that the data processor must provide this
information as soon as the data is recorded or, at the latest, when the data is first divulged to a third party.
This information is not necessary, however, if the sole purpose of the processing is to permit or facilitate
communication by electronic means.
In addition to the obligation to inform people of the mandatory or optional nature of their responses, of the
consequences of any failure to respond, of the recipients of the data and of their right to access and correct
their personal data, Article 32 of Law 2004-801 imposes on data processors the obligation to inform the
person from whom the personal data is collected of the identity of the data processor, the purpose for which
the data is processed, and of their right to object to the information being transferred to a third party, as well
as, where necessary, of any proposed transfers of data to a country which is not a Member State of the
European Community.
This obligation is immediately applicable and concerns all types of processing. Companies have until
August 6, 2007, to comply with the new requirements in respect of processing carried out before Law
2004-801 came into force.
The obligation to provide information also applies to cookies. Article 32-II of Law 2004-801 states that
“anyone using an electronic communications network must be clearly and fully informed [ ] about the
purpose of any action taken (i) to access, by electronic means, information stored in their connection
terminal, or (ii) to enter, by similar means, information in their connection terminal equipment [and] about
the measures they may take to prevent this”.
56 - Iliad – Registration Document 2007