Collection on third-party sites and RGPD

These data processing operations may include "personal data". They are implemented in application of the following missions and prerogatives of Arcom:

• infringement detection powers for sworn agents , who can " extract, acquire or retain (...) evidence " on online public communication services as part of :
  • fight agains online public communication services that seriously and repeatedly infringe royalties or neighbor rights (see articles L. 331-14 and L. 331-25 of the French intellectual property code);
  • fight agains on-line public communication services that reproduce the content of those blocked by court ruling for infringement of royalties or neighbor rights (see articles L. 331-14 and L. 331-27 of the French intellectual property code);
• the power to establish facts likely to constitute infringement of the rights mentioned in article L 333-10 of the French Sports Code (see article L 333-11 of the French Sports Code);
• mission to evaluate "the level of effectiveness of measures taken by online content sharing service providers (...) with regard to their ability to ensure the protection of works and objects protected by copyright and neighbor rights, including their deployment and operating conditions ". As part of this evaluation mission, Arcom's authorized and sworn agents may implement proportionate methods of automated collection of publicly accessible data. (see articles L. 331-18 of the French intellectual property code);
• collect from online platform operators, under the conditions set out in article 19 of the law of September 30, 1986, the information needed to monitor their obligations to fight agains hateful content (see articles 19 and 62 of the law of September 30, 1986, amended following law no. 2021-1109 of August 24, 2021, reinforcing respect for the principles of the Republic);
• studies, by Arcom alone, or with the assistance of the Pôle d'Expertise de la Régulation Numérique (see article 36 of law no. 2021-1382 of October 25, 2021 and nineteenth paragraph of article 18 of the law of September 30, 1986, notably on social networks for which Arcom is responsible);
• power of investigation by sworn agents of Arcom on publishers and distributors of audiovisuel communication services, satellite network operators, companies ensuring the diffusion of audiovisuel communication services as well as video sharing platforms (see article 19 of the law of September 30, 1986).

The lawfulness of the listed processing operations is based on e) of (1) of Article 6 of the General Data Protection Regulation (GDPR). These data processing operations in fact fall within the exercise of the public authority vested in Arcom pursuant to the aforementioned texts.

The personal information (data likely to relate to identified or identifiable natural persons) likely to be collected within the framework of Arcom's missions and prerogatives falls into the following categories:

• identification data (name, user name, numerical user identifier, geographical area) ;
• personal characteristics (age, gender, family situation) ;
• consumer habits ;
• interests ;
• educational and professional background;
• photos and videos;
• any other information published on the website.

The principles of minimization, accuracy, storage limitation, integrity and confidentiality generally govern all personal data processing implemented by Arcom. With regard to research work in particular, the latter ensures that it makes provision for appropriate safeguards within the meaning of Article 89 of the RGPD.

As a matter of principle, data is kept for as long as it takes to process the relevant files. To this period may be added the applicable legal prescription and public archiving periods. In the latter two cases, access to the data is restricted to the litigation and archiving departments, and the data may only be communicated in a justified, ad hoc and detailed manner to other Arcom departments.

The data used is extracted from third-party websites within the scope of the legal responsibilities listed above.

Where possible and relevant, data may be collected specifically via APIs.

Data processing does not involve automated decision-making which, within the meaning of the RGPD, would produce legal effects or significant effects for data subjects.

Data is processed by authorized Arcom staff whose duties so require. They are not transmitted to third parties, except to authorities legally authorized to receive them.

Arcom employees are bound by professional secrecy with regard to any information they may have or have had access to by virtue of their duties.

Personal data may be made public in the context of research work, but only in cases where this is absolutely justified by the purpose of the study (e.g., mention of the name of a national or international political figure and related statistics). In this scheme, the Board enforces the provisions of Decree no. 2019-536 of May 29, 2019, implementing Act no. 78-17 of January 6, 1978 on data processing, data files and individual liberties.

Arcom reminds you that individuals concerned by data processing have a right of access, a right of rectification, a right of opposition and a right to limit processing.

These rights may be exercised with Arcom's Data Protection Officer (DPO) under the conditions specified below. Requests will be examined under the conditions of admissibility of the RGPD (in particular its articles 12 to 22 and its article 89).

Arcom's Data Protection Officer (DPO) is available to answer any questions data subjects may have about the processing of personal data collected from third-party websites.

The DPO can be contacted :

• at the following e-mail address

French regulatory authority for audiovisual and digital communication

For the attention of the Data Protection Officer (DPO)

39-43 Quai André Citroën, 75015 Paris, France

Persons wishing to exercise their rights must provide proof of identity with their request.

Where necessary, the competent administrative authority for personal data processing is the French national data protection agency (CNIL). Complaints relating to the use of personal data may be lodged with the CNIL.