Header graphic for print
Privacy Law Blog

Cecile Martin

Cécile Martin is a Special International Labor & Employment Counsel in the Labor & Employment Law Department in the Paris office. She has experience in all employment law aspects of corporate restructurings (including transfer of undertakings and due diligence), redundancy procedures including dismissing protected employees, settlement negotiations, negotiations with employee representative bodies (personnel delegates, works councils, health and safety committees, unions) and French Labor Authorities (Labor Inspector, Ministry of Employment). Cecile has also developed extensive experience in data privacy law and is generally responsible for cases involving privacy issues at the crossroads of employment law and the law of new technologies, particularly issues concerning the cyber-surveillance of employees and the dismissal of employees for abusing technologies put at their disposal during their work time. Prior to joining Proskauer, she served as in-house counsel for the legal department of the French Data Protection Agency (C.N.I.L.). She has participated as a speaker for the Technology in Practice and in the Workplace Committee of the American Bar Association on several occasions. Cecile is a graduate of University Paris XI.

Posts by Cecile Martin

CNIL Cracks Down on Employee Video Monitoring and Password Strength

Posted in European Union, Workplace Privacy

In a recent decision (deliberation CNIL May 30, 2013 n°2013-139), the French Data Protection Agency (CNIL) sanctioned a company for implementing a CCTV system without informing employees and because the CCTV enabled the constant monitoring of one employee making the recording disproportionate to the goal pursued.  The CNIL also sanctioned the company because it failed… Continue Reading

In France, Are Employers Entitled to Access Their Employees’ Personal Emails?

Posted in Data Privacy Laws, Online Privacy, Workplace Privacy

In France, the guiding principle is that emails received or sent by an employee through the employer’s company email account are considered “professional”, which means that the employer can access and read them.  However, French employers must be cautious before accessing their employees’ professional emails because they are not permitted to access emails that have… Continue Reading

Navigating the Patchwork: When Is European Data Privacy Law Applicable to US Companies?

Posted in Data Privacy Laws, European Union, International, Online Privacy

Are social media companies based in the United States subject to European data privacy laws?  Two recent judicial decisions – one in France and the other in Germany – arrived at different answers.  The Civil Court of Paris held that Twitter, based in California, was obligated under the French Code of Civil Procedure to reveal… Continue Reading

5 Best Practices for Employers Addressing Social Media Use in the Workplace

Posted in International, Workplace Privacy

For the second year in a row, Proskauer has conducted a global survey, “Social Media in the Workplace Around the World 2.0”, which addresses the use of social media in the work place. In 2012, Proskauer surveyed multinational businesses in 19 different countries (Argentina, Brazil, Canada, China, The Czech Republic, France, Germany, Hong-Kong, India, Ireland,… Continue Reading

Is data breach notification compulsory under French law?

Posted in Data Breaches, Data Privacy Laws, Electronic Communications, European Union, Security Breach Notification Laws

On May 28th, the Commission nationale de l’informatique et des libertés (“CNIL”), the French  authority responsible for data privacy, published guidance on breach notification law affecting electronic communications service providers.   The guidance was issued with reference to European Directive 2002/58/EC, the e-Privacy Directive, which imposes specific breach notification requirements on electronic communication service providers. French legislator recently amended… Continue Reading

French employees should check their privacy settings before posting on social media platforms

Posted in International, Online Privacy

It may seem obvious to a lay person that employees should refrain from insulting their companies on social media due to the threat of termination for cause; however, there are contradictory legal principles that apply to the use of social media by employees which can be used both for and against employees (i.e. freedom of speech, right to privacy, data protection laws, an employer’s right to take disciplinary action, public insult offense, etc.) As a consequence, there is uncertainty as to whether an employer can use its employees’ postings made on social media websites to sanction them.

What’s new in Europe?

Posted in International

While the European Commission is seeking to update its 15-year-old Directive regarding the protection of personal data, several regulations have been passed to strengthen privacy rights in Europe. With all this activity, it’s clear that the United States is not the only country trying to adapt its privacy and information security standards to rapidly evolving technologies and marketplaces. Companies with an international presence need to stay alert to stay compliant. We can help!

French Data Protection Agency Restricts the Scope of the Whistleblowing Procedures: Multinational Companies Need to Make Sure They Are Compliant

Posted in Data Privacy Laws

By a decision dated October 14, 2010, and published on December 8, 2010, the French Data Protection Agency (known under the acronym CNIL) revised the deliberation that it issued on December 8, 2005.
At that time, the CNIL had issued a deliberation to reach a compromise between the United States’ Sarbanes-Oxley (“SOX”) requirements and French law. According to Article 1 of that deliberation, companies were authorized to adopt whistleblowing systems implemented in response to French legislative mandates, regulatory internal control requirements (e.g. regulations governing banking institutions), or the whistleblowing requirements of the SOX Act. According to Article 3 of the 2005 deliberation, alleged wrongdoings not encompassed within these core areas may be covered by the whistleblowing system only if vital interests of the company or the physical or psychological integrity of its employees were threatened.

French Data Protection Agency Issues Guidelines to Help Companies Strengthen the Security of their Data Processing

Posted in Data Privacy Laws

To assist companies to comply with European data protection laws, in particular those implemented in France, the French Data Protection Agency (known as “CNIL”) recently issued a set of guidelines organized by topic which provide elementary precautions to be taken by data controllers in several subject areas, including what types of conduct are prohibited as well as the CNIL’s recommendations in these areas.

Opt Out Rejected by the EU Data Protection Authorities for Online Behavioral Advertising

Posted in Online Privacy

In an opinion issued on June 22, 2010, the EU Data Protection Authorities (Article 29 Working Party) clarified the legal framework applicable to online behavioral advertising – an activity that is becoming a hot topic for discussion as its popularity grows. Among other things, the Article 29 Working Party clearly took the position that it is incumbent upon advertising network providers to “create prior opt-in mechanisms requiring an affirmative action by the users indicating their willingness to receive cookies and the subsequent monitoring of their surfing behavior for the purposes of serving tailored advertising.”

French Supreme Court Limits the Scope of the Whistleblowing Processes

Posted in International

The implementation of codes of conduct and whistleblowing systems is expanding at the international level. Global companies must pay attention to local law requirements when rolling out these codes in foreign countries, in order notably to comply with the rules and regulations provided by the local data protection authorities to govern data processing. A recent… Continue Reading

French Data Protection Agency Issues Recommendations Regarding Employees’ Personal Data that Companies in France May Collect To Minimize the Impact of Swine Flu on Business Continuity

Posted in Data Privacy Laws

In anticipation of the Swine Flu and the consequences that it may have upon the continuity of the business of companies, the French Data Protection Agency (known under the acronym "CNIL") recently issued recommendations regarding employers’ collection of employee data in connection with their swine flu business continuity programs. The French government has strongly recommended… Continue Reading

European Privacy Law And Social Networking

Posted in Data Privacy Laws

  With social networking sites proliferating across international boundaries, privacy and data protection concerns are becoming increasingly relevant. With these concerns in mind, the Article 29 Working Party, an independent European advisory body on data protection and privacy, adopted an opinion on online social networking on June 12, 2009. As noted by the Working Party, the… Continue Reading

A New Solution for Global Outsourcing? The EU Commission Considers New SCCs For Cross-Border Data Transfers

Posted in European Union, International

The European Commission is considering modifying the standard contractual clauses (hereafter “SCCs”) established on December 27, 2001 and used by data controllers to transfer personal data to data processors located outside the EU. The new SCCs may introduce more flexibility in processing services and better reflect new business practices. Although the European Commission has not yet… Continue Reading

UK Data Protection Authority Publishes Draft Guidelines for Implementing Privacy Policies

Posted in Data Privacy Laws

The UK Information Commissioner Office ("ICO", the UK data privacy agency) has recently issued an informative code of practice to assist companies collecting personal data so that they can better draft clear privacy notices to data subjects about how the company intends to use personal data, and especially when such data is considered to be… Continue Reading

Focus on the EU and France — Can US Employers Collect Sensitive Data about Their Employees Resident in the EU?

Posted in Data Privacy Laws

US employers are sometimes required for diversity purposes to collect data regarding the race and ethnicity of their employees.  However, collection of such “sensitive” data may infringe EU data protection laws under Article 8 of the EU Data Protection Directive.  This blog post is designed to provide some basic information about Article 8 and its… Continue Reading

French Data Protection Agency Rules that Employees Are Entitled to View Their Evaluations

Posted in Data Privacy Laws

  Earlier this year, CNIL, the French Data Protection Agency, issued a ruling that changed the confidentiality treatment accorded to employee evaluations under French law. CNIL ruled that employees must be able to review any evaluations written about them by their employers. The CNIL issued the ruling after receiving several complaints from employees of an… Continue Reading