Enforcement · French Data Protection Authority (CNIL) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Carrefour France: Non-compliance with general data processing principles

€2,250,000 Fine
Carrefour France
FRANCE
Art. 5 GDPR Art. 12 GDPR Art. 13 GDPR Art. 15 GDPR Art. 17 GDPR Art. 21 GDPR Art. 32 GDPR Art. 33 GDPR
Processing Agreement IP Address Personal Data Direct Marketing Processing International Transfer Supervisory Authorities
Nov 18, 2020 Source

How it connects

Related across sources

News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet News UK data protection reform: How the UK's GDPR may change Hogan Lovells Guidance Guidelines 04/2021 on Codes of Conduct as tools for transfers EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Guidance Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) EDPB

Full text

The French DPA (CNIL) fined Carrefour France EUR 2,250,000 for several violations of data protection regulations, including the GPDR. During its investigation, the CNIL found that the information on personal data provided to users of the carrefour.fr websites and those wishing to join the loyalty program was neither easily accessible nor easily comprehensible. The CNIL also found that the information regarding the transfer of data to countries outside the EU and regarding the duration of data storage was incomplete. The CNIL also notes that the company did not comply with the storage time limits. Furthermore, the data of more than twenty-eight million customers who were inactive for five to ten years were stored for the purposes of the loyalty program. This was also the case for 750,000 users of the carrefour.fr site, who were inactive for five to ten years. The CNIL states that the company required proof of identity for almost every user request to exercise a right. However, this automatic requirement was not justified, as in most cases there was no doubt regarding the identity of the data subjects. Furthermore, the company did not respond to several requests from individuals who wanted to access their personal data. Also, in numerous cases, the company did not carry out the erasure of data requested by individuals. Finally, the company has not responded to several requests from persons who did not agree to receive advertising by SMS or e-mail.

Industry: Industry and Commerce

Original document at the source www.legifrance.gouv.fr

Similar Content