On May 26, 2023, the French data protection authority (CNIL) published Decision No. SAN-2023-007, as issued on May 11, 2023 (Decision of May 11, 2023). The Decision of May 11, 2023 closed the injunction issued against Microsoft Ireland Operations Limited for compliance with Decision No. SAN-2022-023, as issued on December 19, 2022 (Decision of December 19, 2022), in which CNIL fined Microsoft €60 million for failing to make it as easy to reject consent to the use of cookies as it is to accept the same on bing.com, in violation of Article 82 of Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (the Act), following a complaint issued by an individual.

Background to the decision

In particular, CNIL highlighted that, in the Decision of December 19, 2022, it had imposed a fine of €60 million on Microsoft, and that the injunction was accompanied by a fine of €60,000 per day, at the end of the three-month period following notification of the decision, in case of non-compliance. Specifically, CNIL noted that the Decision of December 19, 2022 concerned the placement of cookies with an advertising purpose on user terminals, without their consent being collected.

Findings of CNIL

Further to the above, CNIL noted that Microsoft responded, on March 10, 2023, to the Decision of December 19, 2022, outlining that it had made technical changes to ensure that the cookies placed on the terminals of users of 'bing.com,' and that such changes had been in place since February 24, 2023.

Outcomes

Consequently, CNIL considered that the behavior of Microsoft justified its decision that the penalty payment of an additional €60,000 per day following the violation does not need to be paid.

You can read the press release here and the Decision of May 11, 2023, here, both only available in French.