CNIL (France) - SAN-2021-008: Difference between revisions

Latest revision as of 17:14, 4 March 2022

CNIL (France) - SAN-2021-008

Authority:	CNIL (France)
Jurisdiction:	France
Relevant Law:	Article 5(1)(e) GDPR Article 13 GDPR Article 17 GDPR Article 32 GDPR Article 82 Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés Article L34-5 Code des postes et des communications électroniques
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	14.06.2021
Published:	17.06.2021
Fine:	500000 EUR
Parties:	n/a
National Case Number/Name:	SAN-2021-008
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	Légifrance (in FR)
Initial Contributor:	n/a

The CNIL fined a DIY company a total of €500,000 for violating Articles 5(1)(e), 13, 17, and 32 GDPR and for infringing national provisions concerning cookies and unsolicited commercial communications.

English Summary

Facts

On 13th November 2018, the French DPA (CNIL) carried out an inspection at the Brico Privé's premises, a DIY company, to inspect the company's data retention periods, the information it provides to data subjects, its compliance with requests for the deletion of personal data, data security, and compliance with the obligation to obtain data subject consent to receive commercial prospecting by e-mail.

In order to complete its investigations, the CNIL carried out an online inspection of all processing accessible from the bricoprive.com domain on 6 February 2020.

On 13 January 2021, as the company indicated that changes had been made to the methods of depositing cookies, a delegation from the CNIL carried out a new investigation of any processing accessible from the bricoprive.com domain in order to update the findings made on 6 February 2020.

Holding

The CNIL found that the controller had violated Articles 5(1)(e), 13, 17 and 32 GDPR by failing to comply with the obligation to determine and implement data retention periods, failing to inform web visitors about processing activities, failing to comply with the request for erasure of data, and failing to ensure appropriate security measures regarding authentication on the website and on the customer relationship management software used by the company's employees.

The CNIL also found that the controller had violated national provisions concerning cookies and unsolicited commercial communications.

With regards to Article 5(1)(e), the DPA found that the company did not have a retention policy in place for the deletion of data. The company had data from accounts as old as five years without any activity.

With regards to Article 13, the controller did not offer on their website information such as the contact details of the data protection officer, the retention periods, the legal bases for processing, and certain rights from which individuals benefit under the GDPR.

With regards to Article 17, the company did not delete the data when there were requests from users to delete their account, but only deactivated the accounts, preventing the person from connecting to the account and ending unsolicited commercial communications.

With regards to Article 32, the DPA found that there was not a sufficient level of data security to meet requirements concerning the robustness of passwords, both for users and employees.

With regards to cookies, the DPA found that several cookies that did not fall within the scope of the exceptions (necessary cookies) were placed on the user's terminal as soon as they arrived on the home page of the site, and before any action on their part.

Additionally, the company was sending unsolicited commercial communications to users who created an account for commercial purposes and without obtaining their consent.

Therefore, the CNIL fined Brico Privé €300,000 for violating Articles 5(1)(e), 13, 17 and 32 GDPR and €200,000 for violating Article 82 of the loi n° 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés and Article 34(5) of the Code des postes et des communications électroniques (CPCE) – the national provisions concerning cookies and unsolicited commercial communications.

The CNIL also ordered the controller to bring its processing operations into compliance with the obligations resulting from Article 5(1)(e) GDPR and Article 34(5) of the CPCE, and in particular:

to cease to retain the personal data of former customers at the end of a set period of inactivity and proceed with the purging of such data retained by the company,
to provide evidence of an intermediate archive procedure for customers personal data, established after sorting out the relevant data to be stored and deleting irrelevant data, as well as the starting point of such storage (e.g. for invoices stored for accounting purposes),
to cease unsolicited commercial communications to users who have not given their consent.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

@@ Line 20: / Line 20: @@
 |Date_Published=17.06.2021
 |Year=2021
-|Fine=500
+|Fine=500000
 |Currency=EUR
@@ Line 58: / Line 58: @@
 }}
-The CNIL fined BRICO PRIVÉ €300,000 for violating articles 5(1)(e), 13, 17 and 32 GDPR by failing to comply with the obligation to determine and implement data retention periods, failing to inform users of its website about processing activities, failing to comply with the request for erasure of data subjects, and failing to ensure appropriate security measures regarding authentication on the website and on the customer relationship management software used by the company's employees.
+The CNIL fined a DIY company a total of €500,000 for violating Articles 5(1)(e), 13, 17, and 32 GDPR and for infringing national provisions concerning cookies and unsolicited commercial communications.
-The CNIL also fined BRICO PRIVÉ €200,000 for violations of national provisions concerning cookies and consent to commercial prospection.
 == English Summary ==
 === Facts ===
-On 13th November 2018, the CNIL carried out an inspection at the BRICO PRIVE's premises, where the verification concerned data retention periods, information provided to data subjects, compliance with requests for the deletion of personal data of data subjects, the obligation to ensure data security and the obligation to obtain the consent of the data subject to receive commercial prospecting by e-mail.
+On 13th November 2018, the French DPA (CNIL) carried out an inspection at the Brico Privé's premises, a DIY company, to inspect the company's data retention periods, the information it provides to data subjects, its compliance with requests for the deletion of personal data, data security, and compliance with the obligation to obtain data subject consent to receive commercial prospecting by e-mail.
+In order to complete its investigations, the CNIL carried out an online inspection of all processing accessible from the bricoprive.com domain on 6 February 2020.
+On 13 January 2021, as the company indicated that changes had been made to the methods of depositing cookies, a delegation from the CNIL carried out a new investigation of any processing accessible from the bricoprive.com domain in order to update the findings made on 6 February 2020.
+=== Holding ===
+The CNIL found that the controller had violated Articles 5(1)(e), 13, 17 and 32 GDPR by failing to comply with the obligation to determine and implement data retention periods, failing to inform web visitors about processing activities, failing to comply with the request for erasure of data, and failing to ensure appropriate security measures regarding authentication on the website and on the customer relationship management software used by the company's employees.
+The CNIL also found that the controller had violated national provisions concerning cookies and unsolicited commercial communications.
+With regards to Article 5(1)(e), the DPA found that the company did not have a retention policy in place for the deletion of data. The company had data from accounts as old as five years without any activity.
+With regards to Article 13, the controller did not offer on their website information such as the contact details of the data protection officer, the retention periods, the legal bases for processing, and certain rights from which individuals benefit under the GDPR.
-In order to complete its investigations and after receiving additional documents the CNIL carried out an online inspection of all processing accessible from the bricoprive.com domain on 6 February 2020.
+With regards to Article 17, the company did not delete the data when there were requests from users to delete their account, but only deactivated the accounts, preventing the person from connecting to the account and ending unsolicited commercial communications.
-On 13 January 2021, as the company indicated that changes had been made to the methods of depositing cookies, a delegation from the CNIL carried out a new online control mission of any processing accessible from the bricoprive.com domain in order to update the findings made on 6 February 2020.
+With regards to Article 32, the DPA found that there was not a sufficient level of data security to meet requirements concerning the robustness of passwords, both for users and employees.
-=== Dispute ===
+With regards to cookies, the DPA found that several cookies that did not fall within the scope of the exceptions (necessary cookies) were placed on the user's terminal as soon as they arrived on the home page of the site, and before any action on their part.
+Additionally, the company was sending unsolicited commercial communications to users who created an account for commercial purposes and without obtaining their consent.
-=== Holding ===
+Therefore, the CNIL fined Brico Privé €300,000 for violating Articles 5(1)(e), 13, 17 and 32 GDPR and €200,000 for violating Article 82 of the loi n° 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés and Article 34(5) of the Code des postes et des communications électroniques (CPCE) – the national provisions concerning cookies and unsolicited commercial communications.
-The CNIL fined BRICO PRIVÉ €300,000 for violating articles 5(1)(e), 13, 17 and 32 GDPR and €200,000  for violating article 82 of loi n° 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés and article L.34-5 du code des postes et des communications électroniques (CPCE).
-The CNIL also ordered BRICO PRIVÉ to bring its processing operations into compliance with the obligations resulting from articles 5(1)(e) GDPR and article L. 34-5 of the CPCE, and in particular :
+The CNIL also ordered the controller to bring its processing operations into compliance with the obligations resulting from Article 5(1)(e) GDPR and Article 34(5) of the CPCE, and in particular:
-- cease to retain the personal data of former customers of the company's website at the end of the set period of inactivity, proceed with the purging of such data retained by the company up to the date of the deliberation of the restricted formation and justify the deletion of such personal data beyond a set period of inactivity, which it will be for the company to justify
+* to cease to retain the personal data of former customers at the end of a set period of inactivity and proceed with the purging of such data retained by the company,
-- provide evidence of an intermediate archive procedure for customers' personal data, established after sorting out the relevant data to be stored and deleting irrelevant data, as well as the starting point of such storage (e.g. for invoices stored for accounting purposes)
+* to provide evidence of an intermediate archive procedure for customers personal data, established after sorting out the relevant data to be stored and deleting irrelevant data, as well as the starting point of such storage (e.g. for invoices stored for accounting purposes),
-- cease commercial prospection to prospects who have not given their consent, except by obtaining their consent.
+* to cease unsolicited commercial communications to users who have not given their consent.
 == Comment ==