Privacy Policy

The French regulatory authority for audiovisual and digital communication (Arcom), whose registered office is situated at 2-10 rue Brahms, 75012 Paris, is required to process personal data within the scope of its statutory powers.

This data is processed for specific purposes and retained for the periods set out in the table below:

Purpose 1: Processing of data collected via online forms, emails, post, the switchboard, social media (excluding automated responses) and the chatbot

Details

Personal data may be collected by Arcom to carry out the following operations:

• managing complaints from the public regarding a programme and compiling statistics on this subject;
• handling public complaints regarding the obligations of service editors of online public communication services as set out in Article 47 of Law No. 2005-102 of 11 February 2005 on equal rights and opportunities, the participation and citizenship of people with disabilities;
• handling information on television and radio reception and resolving reception problems;
• handling of SMAD declarations;
• management of ‘operator’ directories;
• management of the remit to encourage the development of legal content supply (reporting of works that cannot be found, reporting of difficulties in using a legally acquired work, and proposals for an inventory of platforms that may be regarded as legal);
• managing contact forms;
• managing a ‘chatbot’ on the Arcom website;
• managing instant messaging modules on Arcom’s social media accounts;
• managing institutional information emails (newsletters);
• creation of a national database on media ownership as provided for by the European Media Freedom Act (EMFA) of 11 April 2024.

Retention period: as a general rule,this data is retained for the duration of the case investigation. In addition to this period, the applicable statutory limitation periods and public archiving periods may apply. In these latter two cases, access to the data is restricted to the legal and archiving departments, and such data may only be disclosed to other Arcom departments on a justified, ad hoc and specific basis.

In the specific case of managing public complaints about a programme and compiling statistics on this matter, as well as managing public complaints regarding digital accessibility, the data is retained for a period of five years from the submission of a case before the court.

In the specific case of Arcom’s newsletter, Arcom retains the email address for as long as the data subject does not unsubscribe (via the unsubscribe link included in the newsletters).

In the specific case of the creation of a national database on media ownership, the data is retained in accordance with the applicable regulations, taking particular account of the principles set out in Article 5 of the GDPR. Data is retained for the period necessary to fulfil the purposes for which it was collected and is updated regularly

In the specific case of Arcom’s chatbot, accessible on its website, this tool operates as of free-text input fields accessible directly via the chatbot interface. Demands are then retrieved and processed in order to provide the user with the most appropriate response possible.

You are strongly advised not to provide any personal information, particularly sensitive data, during these exchanges. The chatbot tools do not distinguish between the sensitivity of the data provided and do not carry out any specific processing on this basis. Furthermore, this data is of no use to Arcom and no data sharing or cross-referencing is carried out by the data controller. The chatbot’s automated responses are for information purposes only and do not constitute automated decision-making within the meaning of data protection legislation. Arcom deletes the chatbot’s conversation histories, which are accessible on the website, on a monthly basis.

Purpose 2: Processing of data collected by the departments responsible for implementing the ‘graduated response’ proceedings

Details

Personal data collected via the ‘I have received a notice’ and ‘I have received a notification letter’ forms part of Arcom’s implementation of the proceedings for sending notices provided for in Article L. 331-20 of the French intellectual property code (graduated response).

This data is recorded in the management scheme for measures to protect works on the internet, authorised by Article L. 331-23 of the French intellectual property code.

Retention period: the data are retained for the periods set out in Article 3 of the Decree of 5 March 2010 on the automated processing of personal data authorised by Article L. 331-23 of the French intellectual property code, referred to as ‘Scheme for the management of measures for the protection of works on the internet’, as amended.

Purpose 3: Data processing relating to Arcom’s monitoring of broadcasters’ programmes to ensure plurality

Details

1) With regard to political plurality, those departments of Arcom whose remitso require, have access to a database of political figures in order to fulfil Arcom’s public authority remit of ensuring compliance with the principle of plurality in the expression of different schools of thought and opinion, as made provision for by the Act of 30 September 1986.

Personal data equivalent to data relating to political opinions is processed in accordance with Article 9(e) of the GDPR (data manifestly made public by the data subject).

Retention period: This data is retained in accordance with the applicable regulations, taking particular account of the principles set out in Article 5 of the GDPR. It is revoked from the database when the data subject is no longer active in political life.

2) With regard to service editors’ compliance with the regulations in the programmes they show, in particular to ensure plurality of schools of thought and opinion in the programmes, personal data may also be collected by Arcom.

The personal data processed are: the identity, functions and roles of the participants; the comments made in the programmes; and, where appropriate, sensitive data within the meaning of Article 9(1) of the GDPR. This data is processed in accordance with Article 9(2)(e) of the GDPR (data which has been manifestly made public by the data subject).

Retention period: this data is retained in accordance with the applicable regulations, taking particular account of the principles set out in Article 5 of the GDPR. It is retained for two years following the closure of the case, plus, where appropriate, the time taken to investigate the case in the litigation department.

Purpose 4: Processing of data collected in the context of Arcom’s dealings with professionals

Details

In order to fulfil Arcom’s public service missions, its departments are required to process personal data in their dealings with professionals (regulated operators, other administrative authorities, judicial authorities, representative bodies from the audiovisual industry, intellectual property and digital sectors, representatives of civil society and academia, technical experts, service providers, etc.).

This processing forms part of the examination of cases, the establishment of expert committees or observatories, the organisation of events or the performance of support functions.

Retention period: this data is retained in accordance with the applicable regulations, taking particular account of the principles set out in Article 5 of the GDPR. The data is retained for the period necessary to fulfil the purposes for which it was collected and is updated annually.

Purpose 5: Processing of data collected via the application logs of its websites

Details

Application logs collect the Internet Protocol address when users browse the websites www.arcom.fr and www.csa.fr, as well as the email address when forms are used. This data is collected for the purposes of incident response, particularly in the event of cyber-attacks or attempted cyber-attacks.

Retention period: these application logs are retained for one year.

Purpose 6: Processing of cookies and trackers

Details

The websites published by Arcom use cookies and trackers.

With regard to the www.arcom.frwebsite and the chatbot

Cookies and trackers requiring the Internet user’s consent are managed via a dedicated scheme, which can be browsed at the bottom of the page under the ‘Cookie Management’ section.

The french national data protection agency allows audience measurement cookies to be exempt from the Internet user’s prior consent. In particular, these trackers must not enable the comprehensive tracking of the Internet user’s browsing activity across different applications or websites. Similarly, these trackers must be used solely to produce anonymous statistical data, and any personal data collected may not be cross-referenced with other processing operations or passed on to third parties, as these operations are not necessary for the service to function. You may opt out of this limited audience measurement via the cookie management tool mentioned in the previous paragraph.

Website:

The cookie management tool itself also places a cookie on your device. This cookie, named ‘Tarteaucitron’, is intended to save your preferences regarding the placement or reading of cookies on the arcom.fr website. This cookie is ‘strictly necessary for the provision of an online communication service at the user’s express demand’ within the meaning of Article 82 of the French Data Protection Act. It does not involve the collection of personal data. For these two reasons, prior consent and the right to object do not apply to this particular cookie.

Chatbot:

In order to ensure the technical continuity of the chatbot available on arcom.fr or to maintain a history of your conversation across the various pages of the website where it is present, the Tolk.ai cookie is set and read on your device. This action is governed by Article 82 of the French Data Protection Act.

Your consent is required for this cookie to be set and read. You may accept or refuse the setting of this cookie at any time by browsing the ‘Cookie Management’ section, which can be found at the bottom of the page. If you refuse, you will not be able to use the chatbot.

Regarding the website www.csa.fr

Cookies and trackers requiring the Internet user’s consent are managed via a dedicatedscheme , which can be browsed in the footer of the website under the ‘Cookie Management’ section.

The french national data protection agency permits audience measurement cookies to be exempt from the Internet user’s prior consent. In particular, these trackers must not enable the comprehensive tracking of the Internet user’s browsing activity across different applications or websites. Similarly, these trackers must be used solely to produce anonymous statistical data, and any personal data collected may not be cross-referenced with other processing operations or passed on to third parties, as these operations are not necessary for the service to function. You have the option to object to this limited audience measurement via the cookie management tool mentioned in the previous paragraph.

The cookie management tool also places a cookie on your device itself. This cookie, called ‘Klaro’, is intended to save your preferences regarding the placement or reading of cookies on the csa.fr website. This cookie is ‘strictly necessary for the provision of an online communication service at the user’s express demand’ within the meaning of Article 82 of the French Data Protection Act. It does not involve the collection of personal data. For these two reasons, prior consent and the right to object do not apply to this particular cookie.

Purpose 7: Public content published on websites operated by Arcom

Details

All public content published on websites operated by Arcom is retained for historical or archival purposes in the public interest. Data subjects may exercise their data protection rights under the conditions set out in the GDPR, in particular Article 89, in accordance with the contact details provided in section 4 of this privacy policy.

Purpose 8: Processing of data collected in connection with the implementation of the Digital Services Regulation (DSR)

Details

As part of its remit under the Digital Services Regulation (DSR), Arcom processes personal data to carry out the following operations: managing the ‘regulated providers’ registers and information on contact points and the legal representative; monitoring the obligations of regulated providers; managing certifications and monitoring the functioning of alternative dispute resolution bodies, managing the granting of ‘trusted flaggers’ status, managing demands for access to data by researchers, handling complaints, cooperating with the competent authorities, and managing injunctions issued by the competent authorities. The categories of personal data concerned by the processing are: identity, contact details, professional experience and role, information provided on a self-declaratory basis by applicants or plaintiffs, and data contained in documents or information media to which Arcom’s members and staff may have access in the course of their duties.

Personal data processed by Arcom is accessible only to its staff who need to know this information in the course of their duties and to the members of its board.

In the context of complaint handling and cooperation with the competent authorities, such data may be forwarded to other competent national authorities, coordinators for digital services in the Member States and the European Commission, as required.

Retention period: this data is retained in accordance with the applicable regulations, taking particular account of the principles set out in Article 5 of the GDPR. The data is retained for the period necessary to fulfil the purposes for which it was collected and is updated annually.

Purpose 9: processing of data collected as part of the remit to ensure the fair representation of diversity in French society

Details

In order to fulfil its remit of ensuring the fair representation of diversity in French society in the audiovisual media, as set out in Article 3-1 of the Act of 30 September 1986, Arcom has introduced a barometer to measure this diversity in the audiovisual media. It covers individuals speaking on air on DTT channels, on radio stations and on on-demand media services during the annual indexing period, excluding non-anthropomorphic characters. The categories of personal data processed relate solely to information concerning individuals appearing in audiovisual programmes, analysed on the basis of criteria that may be perceived by the viewer or listener. This information relates to age, gender, perceived ethnic origin, disability, socio-professional category, place of residence and precarious living conditions. No personally identifiable or individualised data is passed on to third parties.

Retention period: identifying data is retained for the duration of the indexing process and anonymised on the date of publication of the report.

Legal basis.

Generally speaking, data is processed by Arcom for the purposes of carrying out its duties as a public authority or on the basis of a legal obligation to which the authority or an operator is subject.

In specific cases, other grounds apply to the collection of data:

• Arcom’s legitimate interest (in relation to the application logs of websites managed by Arcom and audience measurement for the arcom.fr website);
• the data subject’s consent (in relation to data processing involving cookies subject to the Internet user’s prior consent on websites managed by Arcom).

Whether or not the provision of data is mandatory. The provision of data may be required in order for your demand to be processed

Personal data processed by Arcom is accessible only to its staff who need to know this information in the course of their duties and to the members of its board. In certain limited and specific circumstances, authorised service providers of Arcom and authorities legally entitled to receive such data may be recipients thereof.

Personal data may be made public to service recipients in limited and specific cases provided for by law or by the European Media Freedom Act (EMFA) of 11 April 2024.

Personal data processed by Arcom is handled in accordance with secure technical and organisational measures. Arcom staff and its service providers are required to respect the confidentiality of your information.

Data subjects have the right to access, rectify, object to, erase and restrict the processing of their personal data.

For any enquiries or to exercise their data protection rights in relation to the processing of personal data by Arcom, data subjects may contact its Data Protection Officer (DPO), providing proof of identity with their demand:

• at the following email address

• or by signed letter to the following address:
  French regulatory authority for audiovisual and digital communication
  For the attention of the Data Protection Officer (DPO) Daum .n – 9 rue Brahms – CS 12603 – 75131 Paris Cedex 12

The competent administrative authority for the processing of personal data is the french national data protection agency. Complaints relating to the use of personal data may be lodged with the french national data protection agency.

• Specific procedures for data subjects to exercise their rights in relation to ‘graduated response’ proceedings implemented by Arcom

Data subjects affected by these proceedings have the right of access to and rectification of their data in accordance with Articles 105 and 106 of Law No. 78-17 of 6 January 1978 on information technology, files and civil liberties. However, Decree No. 2010-236 of 5 March 2010 expressly excludes the right to object and sets time limits for the erasure of data.

For any enquiries or to exercise your data protection rights regarding the processing of personal data carried out as part of these proceedings, data subjects may contact the Data Protection Officer (DPO) , enclosing proof of identity with their demand andquoting the reference number appearing on the notice received:

• at the following email address

• or by signed letter to the following address:
  French regulatory authority for audiovisual and digital communication
  For the attention of the Data Protection Officer (DPO)
  Daum.n - 9 rue Brahms - CS 12603 - 75131 Paris Cedex 12

You may provide Arcom with information relating to other individuals. In doing so, you undertake to:

1. inform the individuals concerned of the processing of personal data as detailed above;
2. comply, in general, with the applicable data protection regulations.