Contract analysis

1. Introduction and Authority to Act I am Rachel Bernstein, Partner in the Privacy & Data Security Practice of Calderwood & Harkness LLP. I write on behalf of our client, Aurelius Global Media Group PLC ("AGMG"), a public limited company incorporated under the laws of England and Wales, with its registered office at 140 Threadneedle Row, London EC2R 8AH, United Kingdom. AGMG has duly authorised Calderwood & Harkness

2. Acknowledgment of the Formal Notice and Its Requirements AGMG acknowledges receipt of the Formal Notice MED-2023-097 dated 14 December 2023, which was received at AGMG's registered office on 18 December 2023. AGMG further acknowledges the gravity and importance of the Commission's findings and the compliance requirements set out therein. For the avoidance of doubt and in a spirit of transparency, AGMG wishes to su

3. Request for Extension of the Compliance Deadline In view of the foregoing, AGMG respectfully requests that the CNIL grant a thirty (30) day extension of the compliance deadline established in the Formal Notice, from 14 March 2024 to 14 April 2024. AGMG submits that this request is both proportionate and well-founded, for the following reasons: (a) Scope of voluntary, enterprise-wide remediation. Upon receipt of th

4. Remediation Progress to Date AGMG wishes to provide the Commission with a detailed account of the remediation progress achieved to date, in order to demonstrate both the seriousness with which AGMG has approached the Formal Notice and the substantial work already completed. 4.1 Engagement of Legal Counsel and Technical Consultants On 12 January 2024 — within one calendar month of receipt of the Formal Notice — AGM

5. Remaining Remediation Workstreams and Proposed Timeline The following table sets out the remaining remediation workstreams and their respective target completion dates, all of which fall within the requested extension period: As the foregoing table demonstrates, all remediation workstreams will be completed by 12 April 2024, a full two (2) days before the requested extended deadline of 14 April 2024. This buffer h

6. AGMG's Good Faith and Commitment to Compliance AGMG wishes to emphasise to the Commission several factors that, it respectfully submits, demonstrate its genuine good faith and deep commitment to data protection compliance. First, AGMG's remediation programme goes significantly beyond the scope of the specific complaint regarding aurelius-stream.fr. Rather than adopting a narrow approach limited to resolving the id

1. Consent mechanism redesign — complete overhaul of cookie banners and in-app consent flows to eliminate dark patterns and ensure GDPR-compliant consent across all properties;

2. Server-side pixel remediation — identification and remediation of all server-side tracking pixels firing without valid consent;

3. DPA renegotiation — negotiation and execution of GDPR-compliant data processing agreements with all nine (9) vendors identified as having no DPA or a materially deficient DPA;

4. Vendor audit rights — insertion of contractual audit rights in all vendor DPAs in accordance with Article 28(3)(h) GDPR, enabling AGMG (or its appointed auditors) to conduct and contribute to audits of vendor processing activities;

5. DPIA updates — preparation and approval of updated Data Protection Impact Assessments for all processing activities assessed as presenting a high risk to the rights and freedoms of data subjects;

6. ROPA updates — comprehensive updating of AGMG's Records of Processing Activities to reflect the current state of processing operations across all European properties; and

7. Regulatory response preparation — preparation of a complete compliance response to the CNIL, accompanied by full supporting documentation and evidence. Fourth, the remediation programme is being personally overseen at the most senior levels of AGMG's organisation. AGMG's Group Data Protection Officer, Ms Margaux Fontaine-Li, chairs weekly programme steering committee meetings and has direct reporting access to the

7. Conclusion and Request In light of the substantial remediation progress already achieved, as detailed in Section 4 above, and the comprehensive, group-wide scope of the remediation programme voluntarily undertaken by AGMG — extending well beyond the single website identified in the complaint to encompass all fourteen (14) European websites and three (3) mobile applications — AGMG respectfully requests that the Com