Contract analysis

Section 1: Introduction and Purpose This document constitutes the formal compliance response of Aurelius Global Media Group PLC ("AGMG" or the "Company") to the formal notice (mise en demeure) issued by the Commission nationale de l'informatique et des libertés (the "CNIL") on 14 December 2023, bearing reference MED-2023-097 (the "Formal Notice"). AGMG submits this response through its legal counsel, Calderwood & Har

Section 2: Summary of Deficiencies Identified in Formal Notice MED-2023-097 The Formal Notice identified four principal categories of deficiency in AGMG's data processing practices on aurelius-stream.fr. For the purposes of this response, AGMG addresses each category in turn, providing a precise summary of the CNIL's findings before proceeding, in subsequent sections, to detail the remediation actions taken. 2.1 Pre-

Section 3: Scope of AGMG's Remediation Programme Upon receipt of the Formal Notice, and following the engagement of Calderwood & Harkness LLP as external counsel, AGMG made the decision — voluntarily and on C&H's recommendation — to extend the scope of its remediation programme beyond aurelius-stream.fr to encompass all fourteen (14) of its European-facing websites and all three (3) mobile applications. This decision

1. Consent Mechanism Redesign — Complete redesign and redeployment of cookie consent mechanisms across all 14 European websites and 3 mobile applications, including elimination of dark patterns, implementation of symmetric "Accept All" / "Reject All" functionality, removal of pre-ticked consent boxes, and integration with a certified consent management platform.

2. Server-Side Tracking Pixel Remediation — Identification, audit, and remediation of all server-side tracking pixels deployed across AGMG's European digital properties, ensuring that no pixel transmits personal data to third-party vendors without prior affirmative consent.

3. Data Processing Agreement Renegotiation — Review, renegotiation, and execution of GDPR Article 28-compliant data processing agreements with all adtech vendors receiving personal data from AGMG's European digital properties, including implementation of audit rights, sub-processor controls, and data deletion obligations.

4. Vendor Audit Rights Implementation — Establishment of contractual and operational frameworks enabling AGMG to exercise its rights of audit and inspection over processors' data processing activities, including annual audit scheduling and incident-triggered audit procedures.

5. Data Protection Impact Assessment Updates — Update of AGMG's Data Protection Impact Assessments to reflect remediated data flows, updated consent mechanisms, revised vendor DPAs, and new cross-border transfer safeguards, with a focus on the high-risk processing activities of programmatic advertising and audience analytics.

6. Record of Processing Activities Update — Comprehensive update of AGMG's Article 30 GDPR Records of Processing Activities to reflect all remediated processing activities across the 14 European websites and 3 mobile applications.

7. Regulatory Response Preparation — Preparation of the present compliance response to the CNIL, together with all supporting exhibits and technical documentation. The technical audit underpinning the remediation programme was conducted by Thistlewood Consulting Ltd, under the direction of Marcus Drayford, Principal Consultant. The audit commenced on 22 January 2024 and was completed on 16 February 2024, with the fin

Section 4: Technical Cookie Audit Findings and Remediation 4.1 Audit Methodology A full technical scan of all fourteen (14) European websites and three (3) mobile applications was conducted by Thistlewood Consulting Ltd between 22 January 2024 and 16 February 2024. The audit was performed under the direction and supervision of Marcus Drayford, Principal Consultant, Thistlewood Consulting, and was coordinated with Cal

Section 5: Dark Pattern Elimination and Consent Mechanism Redesign 5.1 Scope of Dark Pattern Issues Identified The CNIL's Formal Notice specifically addressed dark pattern practices on aurelius-stream.fr. AGMG's own internal review, conducted as part of the wider remediation programme, identified that dark pattern issues extended across multiple properties in AGMG's European digital portfolio. The findings were as fo

Section 6: Adtech Vendor Data Processing Agreement Remediation 6.1 Vendor Landscape AGMG's European digital properties utilise a total of twenty-three (23) adtech vendors for the purposes of programmatic advertising, audience analytics, ad verification, attribution, and related advertising technology functions. These vendors process personal data obtained from users of AGMG's European websites and mobile applications

Section 7: Cross-Border Data Transfer Remediation Prior to the commencement of the remediation programme, Calderwood & Harkness's review identified that six (6) of AGMG's adtech vendors were transferring personal data originating from AGMG's European digital properties to destinations outside the European Economic Area without adequate safeguards within the meaning of Chapter V of the GDPR. Specifically: • Four (4) v

Section 8: Updated Data Protection Impact Assessments In connection with the remediation programme, AGMG has undertaken to update its Data Protection Impact Assessments ("DPIAs") for the processing activities identified as presenting a high risk to the rights and freedoms of data subjects, pursuant to Article 35 of the GDPR. The processing activities subject to updated DPIAs include: (a) Programmatic advertising, inc

Section 9: Updated Records of Processing Activities AGMG's Records of Processing Activities ("ROPA"), maintained pursuant to Article 30 of the GDPR, are being updated to reflect all remediated processing activities across the Company's European digital properties. The existing ROPA required updating to account for the changes in data flows, consent mechanisms, vendor relationships, and cross-border transfer safeguard

Section 10: Remediation Timeline Summary The following table provides a comprehensive summary of all key remediation milestones, with dates, from the commencement of the remediation programme through the submission of this compliance response and the anticipated delivery of remaining documentation: AGMG confirms that all remediation actions directly affecting user-facing consent mechanisms, cookie deployment behaviou

Section 11: Ongoing Compliance Governance Framework In addition to the specific remediation actions described in this response, AGMG has committed to implementing a forward-looking compliance governance framework designed to prevent the recurrence of the deficiencies identified in the Formal Notice and to ensure the ongoing compliance of AGMG's European digital properties with the GDPR, the ePrivacy Directive, and ap