My understanding is that CNIL works/worked on data privacy issues, which does not appear to be related to the issue of reverse engineering. You might be thinking about the Directive on Privacy and Electronic Communications (2002/58) http://en.wikipedia.org/wiki/Directive_on_Privacy_and_Electr....