QWANT: The CNIL Reminds the Company of Its Obligations Regarding the Processing of Personal Data

The protection of personal data has become a crucial issue in the digital age, where every online interaction generates a multitude of information that may be exploited. The case of QWANT, the French search engine, is a prime example of the challenges that companies face in complying with data protection regulations. Indeed, the CNIL, the regulatory authority in France, recently reminded QWANT of its legal obligations regarding the processing of personal data, emphasizing the importance of full transparency towards users. This situation raises fundamental questions about the distinction between anonymized data and personal data, as well as about companies' responsibilities under the GDPR. In this article, we will explore the legislative framework surrounding QWANT, the reasons why the CNIL classifies its data as personal data, the changes made to the company's privacy policy, and the implications of the formal reminder of legal obligations issued by the CNIL.

If you wish to engage a lawyer specializing in personal data law, contact me!

Why does the CNIL consider QWANT's data to be personal data?

The question of how to classify the data processed by QWANT was at the heart of the analyses carried out by the CNIL. In 2019, the CNIL was faced with a complaint asserting that the information collected by QWANT was not anonymous but instead constituted personal data, thereby subject to the GDPR. Indeed, even though QWANT claimed to use anonymization techniques, the CNIL found that the methods implemented did not guarantee that users could not be re-identified. This finding rests on the idea that data such as IP addresses, even when truncated or hashed, may still allow indirect links to individuals.

This analysis led to an essential clarification: contrary to QWANT's assertions, the technical information transmitted to MICROSOFT in order to display contextual advertising and carry out other marketing operations is regarded as personal data. Indeed, the CNIL emphasizes that mere pseudonymization cannot suffice to rule out the classification as personal data, particularly where the information can be cross-referenced with other available data. Accordingly, QWANT had to comply with its obligations of information and transparency towards users, a key requirement of the GDPR. This position taken by the CNIL is a reminder of the crucial importance of personal data regulations and calls on companies to remain vigilant as to the nature of the data they collect and process. Now, we will examine the changes QWANT made to its privacy policy following this clarification by the CNIL.

Let's discuss your needs for 15 minutes!

What changes did QWANT make to its privacy policy following the CNIL's conclusions?

The evolution of QWANT's privacy policy following the observations made by the CNIL in 2019 reflects a willingness to adapt to regulatory requirements. In response to the authority's reclassification of its data, QWANT made significant changes to its privacy policy in 2020. The main objective of these adjustments was to ensure strict compliance with the GDPR and to inform users transparently about the processing of their personal data. First, the company introduced a more appropriate term, describing the data transmitted to MICROSOFT as "pseudonymous". This nuance is essential because it indicates an acknowledgment of responsibility regarding the nature of the data processed and highlights the fact that genuine anonymization was not in place. This change allowed QWANT to address, in part, the criticisms raised by the CNIL regarding the risks of user re-identification.

On the other hand, QWANT also clarified the advertising purpose of transmitting data to MICROSOFT, as well as the legal basis justifying this processing. These clarifications reinforced the transparency required by data protection regulations. Users can now better understand how their data is used, particularly in the context of contextual advertising, which is less intrusive than behavioral advertising. This change of course also shows that the company intended to fully comply with its information obligations, provided for in Articles 12 and 13 of the GDPR. Finally, to reinforce the consistency and uniformity of the information communicated internationally, QWANT ensured that its privacy policy was updated in all available languages. This reflects a desire to harmonize the level of information provided to users across the various markets in which QWANT operates. Through these changes, QWANT clearly signaled its commitment to complying with the legislative framework on personal data and to correcting the previous perception of its privacy policy. This transparency initiative is a step in the right direction towards regaining users' trust.

I want reliable legal documents!

What is the nature of the formal reminder of legal obligations issued by the CNIL, and what are its implications for QWANT?

This measure, although not punitive, underscores the need for the company to comply with the applicable legislative frameworks, in particular the GDPR. The formal reminder of legal obligations entails immediate and long-term adjustments for QWANT in its data management. This means the company must ensure that its privacy policy is not only clear and precise, but also that it faithfully reflects its data processing practices. The information obligations, as set out in Articles 12 and 13 of the GDPR, remain paramount. This means that QWANT must provide users with complete information about the nature of the data collected, the purposes of its processing, and users' rights.

Another aspect to consider is QWANT's good faith in this matter. Although errors of interpretation as to the classification of the data led to breaches, the CNIL acknowledged the efforts made by QWANT to implement technical measures aimed at reducing the risk of re-identification. This factor of good will enabled the company to avoid more severe penalties, such as a fine. However, this does not eliminate the need for ongoing development of the privacy policy to align its practices with compliance with legal standards. The CNIL, as the supervisory authority, remains vigilant regarding companies' compliance with data protection requirements.

The QWANT case shows that administrative adjustments can be undertaken to prevent potential breaches, while offering an opportunity for remediation to companies that cooperate with the authorities. In this context, QWANT must now establish an ongoing dialogue with the CNIL to ensure that its practices can evolve within a framework that respects users' rights. As QWANT commits to strengthening its practices regarding personal data protection, it is essential to remain attentive to users' reactions to these changes and to the transparency of the information provided. The challenges surrounding personal data management remain complex, and companies must navigate this constantly evolving field with care.

For more information, please consult the CNIL's article: https://www.cnil.fr/fr/qwant-cnil-traitement-des-donnees-personnelles-rappel-obligations-legales.