2020 Annual Financial Report

The reader should note that the figures above are those published by the groups concerned, in the currency and according to the accounting standards used by each of them.

Publicis Groupe also competes with a large number of local, independent advertising agencies in markets around the world, via its Specialized Agencies and Marketing Services. New competitors have emerged in the IT/consulting sectors, such as Accenture, Deloitte and Capgemini, primarily through advertising acquisitions, such as Accenture’s 2019 purchase of Droga5.

Generally speaking, the advertising and communications markets are highly competitive and the Groupe is in constant competition with national and international agencies. The Groupe expects that competition will continue to stiffen as multinational advertisers increasingly consolidate their budgets among a restricted number of agencies, and the communications sector sees significant changes, reflected in the appearance of new competitors from the consulting or high-tech industries.

1.3.8 Regulatory environment

Some of the Groupe’s businesses are governed by regulations that may vary from country to country or region to region.

In France, media buying activities are subject to the Sapin Law, a law requiring transparency in media buying transactions. Pursuant to the Sapin Law, an advertising agency may not purchase advertising space from media companies and then resell the space to clients on different terms. Instead, the agency must act exclusively as the agent of its clients when purchasing advertising space. The Sapin Law applies to advertising activities in France when the media company and the client or the advertising agency are French or located in France.

Many countries have strict laws governing the advertising and marketing of certain products, in particular tobacco, alcohol, pharmaceuticals and foodstuffs. New regulations or standards imposed on the advertising or marketing of such products could have an adverse impact on the Groupe’s operations.

These regulations can change frequently: their scope can be amended at any time; new regulations can be introduced—including without prior notice; and as the Groupe develops, it may expand into areas covered by regulations that did not previously apply to it. One result of the United Kingdom’s exit from the European Union (Brexit) could be to introduce changes to applicable regulations. Any new regulations or amendments to how existing laws or regulations are implemented or applied, or if the Groupe becomes subject to new regulations could have a material impact on the Groupe.

Even though the nature and scope of regulations vary between countries, Publicis Groupe is governed by the data protection laws and regulations in the majority of countries it is active in.

The Groupe updated its data privacy policy in line with current regulations and, in particular, the EU General Data Protection Regulation (Regulation [EU] 2016/679 of April 27, 2016, GDPR), which came into force in May 2018.

The GDPR applies to all organizations (i) that process personal data related to the activities of an establishment in the territory of the European Union (EU) or (ii) that process data related to the offering of goods or services to persons located in the territory of the EU or to the monitoring of their behavior. The GDPR is based on a set of principles applicable to the processing of personal data, including the principle of data minimization, which consists in limiting the processing of personal data to that which is necessary for the purposes for which they are processed. Moreover, the “privacy by design” and “privacy by default” principles require companies to implement appropriate technical and organizational measures to protect personal data when new products and services are designed. The GDPR also creates obligations for data controllers and their sub-contractors to make businesses more accountable. They include notifying to the supervisory authorities, and in some cases, to the individuals concerned, personal data breaches that are likely to engender a risk to the rights of those concerned. Companies that process a large amount of personal data, like Publicis, are also required to maintain records of their processing activities and to appoint a data protection officer. Just as it tightened obligations incumbent on companies, the GDPR also created and reinforced the rights of individuals, in particular with regard to their right to information on how their data is processed. The regulation also lays down the framework for transfers of personal data outside the EU to ensure that individuals enjoy a sufficient and appropriate level of protection. The GDPR provides for administrative penalties including fines of up to euro 20 million or 4% of global annual revenue for the most serious breaches. These sanctions have already been used by the supervisory authorities in Europe since the GDPR came into force are evidence of their increased vigilance. In addition to the regulations, the recommendations of the national organizations responsible for monitoring compliance with these rules as well as case law can have a significant influence on the level of protection required and the organization to be put in place. For example, guidelines no. 2020-91 and recommendation no. 2020-92 of September 17, 2020 of the CNIL in France on the installation of cookies and the Schrems II C-3111/18 ruling of July 16, 2020 of the Court of Justice of the European Union on the transfer of data outside the European Union. In parallel, Directive 2002/58/EC, dubbed the “ePrivacy” Directive, as amended, lays down rules to guarantee protection of privacy in the electronic communications sector. Transposed into French law by Law no. 2004-575 on confidence in the digital economy, this directive imposes obligations with respect to marketing and introduces rules on how cookies are used. The e-Privacy directive is being revised and is expected to be replaced by an e-Privacy regulation that will be directly applicable in the EU.

Other countries have also passed legislation to protect personal data. In the US, California passed the California Consumer Privacy Act of 2018 (CCPA), applicable as of January 1, 2020. In November 2020, the State of California passed a law that revises and expands the CCPA (California Privacy Rights Act, “CPRA”). The CPRA will come into force on January 1, 2023, when it will replace the CCPA. The main provisions of the CCPA and the CPRA oblige companies that process personal information about consumers residing in California to inform them about their data collection, use and sharing practices. They also allow Californian consumers to object to their information being shared with third parties and grant them a new right to sue for breach of their private data. In addition, on March 2, 2021, the State of Virginia in the United States adopted a law strengthening the protection of consumer data (Virginia Consumer Data Privacy Act), which will come into force on January 1, 2023.