In a short but very important judgement of 25 June 2013, the Cour de cassation, the French Supreme Court, has ruled that the sale of a computerized customer file is null and void if the French personal data authority CNIL has not been notified of the file in compliance with article 22 of the French personal data Act.
In the present case, a natural person brought a case against a company, claiming that the sale of a computerized customer file containing personal data had to be annulled, because the CNIL had not been notified of the file. To dismiss this claim, the Court of Appeal of Rennes, in a judgement of 22 January 2012, after finding that the customer file held by the company should have been declared to the CNIL, ruled that the law does not provide that the absence of such a notification entails the nullity of the data sale agreement.
The Supreme Court quashed this judgement: Since the computerized file containing personal data must be notified to the CNIL, the sale of the file has an unlawful object in absence of such notification. This decision is based on article 1128 of the French Civil Code, which provides that “Only things which may be the subject matter of legal transactions between private individuals may be the object of agreements.” In other words, if the object of the contract is unlawful, such agreement is null and void.
This ruling has direct and very important consequences on copyright deals such as database sales agreements, where personal data is sold. For such dealings, both the buyer and the seller should be extremely cautious and audit the database and the applicable law.