CNIL: Only a Substantial Modification of Declared Data Requires a New Declaration

You manage a small building in Antibes and, as every year, you update the property management software. Nothing too complicated: a new version, some security patches, the interface changes a bit. But suddenly, your accountant warns you: "Be careful, if you modify the processing of your tenants' data, you may need to make a new declaration to the CNIL." Panic sets in: do you have to start all over? How long will it take? How much will it cost?

This question is asked daily by hundreds of landlords, property managers, and real estate professionals. Because personal data protection has become a major issue, and even a small mistake can be costly. But what is really considered a change requiring a new declaration? The answer is in a judgment of the French Supreme Court (Cour de cassation) of 23 April 2013 (No. 11-26.099), which clarifies a key concept: "substantial modification."

In short, the Court tells us that only a modification that affects the information that has been previously declared to the CNIL must be reported. A simple technical update of software does not trigger the obligation to make a new declaration. But caution: you still need to know what is "substantial" and what is not. Let us decode this decision together, with concrete examples to guide you.

The facts: a story like many that happen every day

The case concerns a residential care centre for minors, run by an association. For its operation, it uses management software that records data on educators and children in care. In 2007, the management decided to switch from one software to another. Nothing unusual: an update, a change of supplier, improved features. But an employee challenged this transition, arguing that the data collected was personal and that the change of software should have been declared to the CNIL beforehand. He brought a claim before the employment tribunal for damages.

The employee argued that the data recorded (names, first names, ages, etc.) was personal data, and that the modification of the processing required a prior declaration. The association, on the other hand, argued that switching from one software to another was merely a technical update, without impact on the nature of the data processed. The court of appeal ruled in favour of the employee, holding that since the data was personal, any modification of the processing had to be declared. But the association appealed to the Supreme Court.

The Supreme Court quashed the appeal judgment. It criticised the lower court judges for not having considered whether the change of software was in fact merely an update, which does not require a new declaration. In other words, it is not enough that the data is personal for a modification to be considered substantial. It must also affect the information that has been declared to the CNIL. If the new software processes the same data in the same way, it is only a technical evolution, not a substantial change.

The reasoning of the court — decoded

The reasoning of the Supreme Court is based on Article 22 of the French Data Protection Act of 6 January 1978 (Loi Informatique et Libertés), in its version applicable at the time. This article provides that processing of personal data must be declared to the CNIL, subject to exceptions. But it also states that "any substantial modification of the information contained in the declaration" must be brought to the attention of the Commission. The question is therefore: what is a substantial modification?

The Court answers by distinguishing two things: on the one hand, the nature of the data processed (personal or not); on the other hand, the subject matter of the declaration (the information declared). A substantial modification is a change that affects the information you have provided to the CNIL: the purpose of the processing, the categories of data, the recipients, the retention period, etc. By contrast, a mere technical update — such as moving from one software to another without changing these elements — is not substantial.

In other words, the Supreme Court says: "Do not focus on the name of the software or its version. Instead, look at what actually changes in the data processing." If you switch from Excel to professional software, but continue to collect the same information for the same purposes, without sharing it with new recipients, there is no substantial modification. What few people know is that this decision was rendered under the old law, but it remains relevant today under the GDPR (General Data Protection Regulation), which requires an impact assessment for substantial modifications.

However, caution: this decision should not be interpreted as a carte blanche. If the update involves, for example, the addition of sensitive data (health, political opinions, etc.), or a change of purpose (from property management to marketing), then that is a substantial modification. undefined, I have come across cases where a simple change of hosting provider was considered substantial because the data was transferred to a country outside the EU. Everything depends on the context.

What this means for you — concretely

For a landlord in Antibes or Cannes, this decision is reassuring. You use property management software to track rents, receipts, and inventory reports. You change software? Before panicking, ask yourself three questions: what data is processed? for what purposes? who has access to it? If the answers are the same, you do not need to make a new declaration. However, if you decide to add a tenant rating module (a rating that would be shared with other landlords), that is a substantial modification.

For a tenant, the impact is indirect but real. You are entitled to know what data is collected about you and why. If your landlord changes software, ask them whether it changes anything in the processing of your data. They must be able to answer you. If they do not, you can contact the CNIL.

For a property manager (syndic) in Cannes, the same question arises. You manage a building with 50 units, using software that records the names of co-owners, their addresses, and their service charges. You switch to an online software. Is this a substantial modification? Not if the data remains the same and the provider is in the EU. But if the new software allows publishing unpaid debts on a website accessible to all co-owners, that is a change of purpose requiring a declaration.

Example with figures: a landlord in Cannes had to pay €3,000 in lawyer's fees to defend a failure to declare to the CNIL following a change of software. With a prior consultation costing €45, he could have avoided this litigation. The 2013 decision would have allowed him to demonstrate that the update was not substantial, but he chose to settle to avoid a lengthy procedure.

If you are in this situation, you should: 1) keep evidence of your initial declaration to the CNIL; 2) document the change (what, when, why); 3) check whether the declared information is modified; 4) if in doubt, consult a lawyer lawyer.

Four tips to avoid this type of dispute

• Keep your initial CNIL declaration safe. Whether it is a paper copy or the declaration number, keep it. It is your reference point for assessing any subsequent changes.
• Document each software update. Note the date, version, features added or removed, and especially whether the categories of data or purposes change. This will be useful in case of an inspection.
• Carry out a proportionality test. Before changing software, ask yourself: does this change affect the rights of the data subjects? If yes, it is likely substantial. If no, you can proceed without a new declaration.
• Consult a lawyer if in doubt. A simple update can sometimes conceal a substantial change (e.g., addition of biometric data). Better to pay €45 for a consultation than €3,000 for proceedings.

Further reading: related case law and developments

This decision is part of a consistent line of the Supreme Court, which clearly distinguishes technical evolution from substantial modification. One can cite a judgment of 8 December 2009 (No. 08-43.592) where the Court already held that a simple change of physical medium (moving from a paper file to a computer file) was not a substantial modification. On the other hand, a judgment of 10 May 2012 (No. 11-14.072) recalls that the addition of sensitive data (such as racial origin or political opinions) always constitutes a substantial modification, even if the software remains the same.

With the entry into force of the GDPR in 2018, the concept of "substantial modification" has been reinforced. Now, any modification that increases risks to the rights and freedoms of individuals must be subject to a Data Protection Impact Assessment (DPIA). The 2013 case law therefore remains relevant, but must be read in the light of the GDPR. Courts continue to refer to it to determine whether a change is technical or substantial.

The trend of the courts is clear: they favour a pragmatic approach. What matters is not the name of the software, but the concrete effect on the data. In the future, one can expect judges to be increasingly vigilant about changes in purpose or recipients, especially in the context of short-term rentals and platforms like Airbnb, where data is often shared with third parties.

Summary and next steps

FAQ:

1. Do I need to make a new CNIL declaration if I change my property management software? Not if the new software processes the same data for the same purposes. If yes, check whether the declared information changes.
2. What should I do if my property manager changes software without informing me? Ask them whether the change is substantial. They must answer you. If they refuse, contact the CNIL.
3. What are the risks if I fail to declare a substantial modification? A fine of up to €20 million or 4% of annual worldwide turnover (GDPR). In practice, sanctions against individuals are rare, but the risk of litigation with a tenant or employee is real.
4. Can I rely on this 2013 decision to defend my change of software? Yes, provided you can prove it is a mere update. Keep evidence: comparison of features, emails, etc.

Checklist "What to do if you change software":

• ☐ Consult your initial CNIL declaration
• ☐ List the data processed before and after the change
• ☐ Check whether the purpose, recipients or retention period change
• ☐ If everything is identical: no new declaration, but keep a written record
• ☐ If an element changes: carry out a DPIA and declare the modification to the CNIL

Besoin d'un conseil personnalisé ? Contactez Maître Zakine — première consultation 30 min à 45€.

Are you in a similar situation? A 30-minute initial consultation with Maître Zakine (€45) can save you months of proceedings — and often much more. Book an appointment →