Customer file not declared to the CNIL: unlawful sale and nullity of the contract

Imagine: you own a business in Sélestat, and you decide to sell your business. The buyer examines the accounts, the stock, the lease. But what about your customer file? That address book, those emails, those phone numbers patiently collected over the years. You may think that this file is part of the saleable assets, like a piece of furniture or a stock of goods. However, the Court of Cassation ruled in 2013: an automated customer file not declared to the CNIL is not in commerce, and its sale has an unlawful object. In other words, if you have not complied with personal data regulations, you cannot profit from the sale of that file. A lesson that can be costly for a negligent seller, and offers unexpected protection for the buyer.

This decision, relatively unnoticed outside legal circles, nevertheless deserves your full attention. Whether you are a trader in Illkirch-Graffenstaden or anywhere in France, it directly concerns you. Because behind a technical question lies a simple principle: no one can sell what is unlawful. And an undeclared customer file is like stolen goods: its sale is void.

So, how to avoid finding yourself in this situation? What to do if you have already bought a business with such a file? And above all, how to secure your transfer? That is what we will see together, step by step, through the analysis of this judgment and its practical consequences.

The facts: a story like many others

Mr X, owner of a business in Rennes, decides to sell it to Mr Y. The contract includes intangible assets: the goodwill, the lease, and... an automated customer file. Yes, that famous file containing names, addresses, emails and purchasing habits of customers. The seller never declared this file to the CNIL (National Commission for Information Technology and Civil Liberties), as required by the Data Protection Act of 1978, amended in 2004. After the sale, the buyer discovers the truth: the file is not compliant. He then refuses to pay the balance of the price, arguing that the sale is void because its object is unlawful.

The seller, on the other hand, considers himself wronged: the file was an element of the business, it was part of the negotiation. He sues the buyer for payment of the price. The Court of Appeal of Rennes, initially, rules in his favour: it orders the buyer to pay the balance. But the buyer appeals to the Court of Cassation. The Court of Cassation, in its judgment of 25 June 2013, quashes the appeal judgment. It recalls that "the sale of an automated customer file not declared to the CNIL has an unlawful object" and, consequently, the sale is void. The case is referred back to the Court of Appeal of Rennes, differently composed, to draw the consequences of this nullity.

What is striking in this story is that the seller may have thought he was doing the right thing by including a "turnkey" customer file. But he forgot the essential: the CNIL declaration. And that was enough to ruin everything. For the buyer, it is a godsend: he can obtain the nullity of the sale, or at least a reduction in price. For the seller, it is a disaster: he loses part of the price, and must also become compliant.

The reasoning of the court — dissected

The Court of Cassation relies on two pillars: contract law and the protection of personal data. On one hand, Article 1128 of the Civil Code (in its version prior to 2016) provides that "the commerce of things which are not in commerce" is prohibited. An undeclared file, according to the Court, is not "in commerce" because its very possession is unlawful. On the other hand, the Data Protection Act imposes a prior declaration to the CNIL for any automated processing of personal data (Article 22 of the 1978 law, taken up in Article 31 of the 2004 law). Now, a customer file containing names, addresses, etc., is an automated processing of personal data. Not declaring it makes the file unlawful, and therefore its sale impossible.

The reasoning is relentless: if the object of the contract is unlawful, the contract is void. It does not matter that the seller believed in good faith that his file was saleable. The nullity is absolute, and can be invoked by the buyer. The judges did not stop at the seller's argument that the file was part of the business: they considered that the protection of personal data prevails over contractual freedom.

This judgment is a confirmation of previous case law, but it clarifies it on an important point: it is not only about sensitive data, but any automated customer file, even if it only contains ordinary information (name, address, phone number). The CNIL itself considers that this data is personal and that its processing must be declared, except in certain simplified cases (simplified standard no. 48).

The buyer's arguments: "This file is not compliant, so I don't have to pay for it." Those of the seller: "I sold my business, the file is part of it, you must pay." The Court ruled in favour of the buyer, but beware: this does not mean that the buyer can keep the file for free. Nullity leads to a restoration of the previous state: the buyer must return the file (and therefore delete it), and the seller must return the price. But in practice, the buyer can negotiate a reduced price in exchange for regularisation.

What this means for you — concretely

If you are the owner of a business in Illkirch-Graffenstaden, and you are considering selling it, you must imperatively check that your customer file is declared to the CNIL. Otherwise, your sale risks being annulled, or at least the price reduced. Example: a business worth €200,000 where the customer file represents 20% of the value (€40,000). If the file is undeclared, the buyer can demand a reduction of the price by €40,000, or even total nullity if the file was an essential element of the sale.

If you are a buyer, you hold a trump card: during negotiations, ask to see the seller's CNIL declaration. If it does not exist, you can demand a price reduction or regularisation before the sale. And if the sale has already taken place, you can take action for nullity or price reduction, within a period of 5 years from the sale (general limitation period).

For tenants or co-owners, this decision has less direct impact, but it illustrates the importance of data compliance. If you are a co-owner and your managing agent uses a file of co-owners without a CNIL declaration, he could be in breach. But that does not directly affect your lease or charges.

In summary: an undeclared customer file is a time bomb in a transfer. Better to defuse it upstream.

Four tips to avoid this type of dispute

• Declare your customer file to the CNIL before any sale. The declaration is simple and free on the CNIL website. It can be done online via the Cerfa form or the online service. If you use management software, check that it has not already been declared by the publisher.
• Require the seller to provide a copy of the CNIL declaration when acquiring. Do not settle for a verbal promise. Ask for the declaration receipt. If the seller cannot provide it, it is a warning sign: the file may be unlawful.
• Include a condition precedent in the sale deed. This clause would make the sale conditional on the regularisation of the customer file with the CNIL. Thus, if the seller does not regularise, the sale is cancelled without cost to the buyer.
• In case of dispute, consult a specialist lawyer. The limitation periods (5 years) and financial consequences (nullity, price reduction) justify swift action. A lawyer can also help you negotiate an amicable settlement.

Further reading: related case law and developments

This decision is part of a protective line for personal data. Already, in a judgment of 30 May 2000 (no. 98-12.681), the Court of Cassation had ruled that the sale of a customer file without CNIL declaration was void. The 2013 judgment confirms and extends this solution to automated files, even non-sensitive ones. Since then, the CNIL has strengthened its controls, and the General Data Protection Regulation (GDPR) of 2018 has imposed even stricter obligations (consent, right of access, etc.).

The trend is therefore towards increased protection of data. Courts are increasingly severe: a non-compliant file can lead not only to the nullity of the sale, but also to criminal penalties of up to 5 years' imprisonment and a fine of €300,000 (Article 226-16 of the Criminal Code). For the future, it is likely that judges will extend this nullity to other intangible assets such as databases or prospecting lists.

In practice: what to do

1. Check if your customer file is declared to the CNIL. Log on to the CNIL website, "Declarations" section. If you have never declared, do so without delay.
2. If you are about to acquire a business, ask for the declaration receipt. If the seller cannot provide it, negotiate a price reduction or a regularisation clause.
3. If the sale has already taken place and the file is undeclared, you have 5 years to act. Consult a lawyer to assess your options: nullity of the sale, price reduction, or damages.
4. In case of dispute, gather evidence: sale deed, correspondence, any document showing the absence of declaration.

Are you in a similar situation? An initial 30-minute consultation with Maître Zakine (€45) can save you months of proceedings — and often much more. Book an appointment →