Enforcement · French Data Protection Authority (CNIL) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

UBEEQO INTERNATIONAL: Non-compliance with general data processing principles

€175,000 Fine
UBEEQO INTERNATIONAL
FRANCE
Art. 5 GDPR Art. 12 GDPR
IP Address Personal Data Processing Agreement Processing Human Resources Supervisory Authorities
Jul 7, 2022 Source

How it connects

Related across sources

Case Law Deutsche Wohnen SE v Staatsanwaltschaft Berlin CJEU Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB News Greek SA fines Clearview AI for EUR 20M IAPP News ICO Publishes Draft Employee Monitoring Guidance for Consultation Hunton Andrews Kurth News De ICO publiceert een conceptrichtlijn over het monitoren van werknemers ter beoordeling. Hunton Andrews Kurth

Full text

The French DPA (CNIL) has fined the company UBEEQO INTERNATIONAL EUR 175,000. The vehicle rental company had collected geolocation data on rented vehicles at every 500 meters. The company stated that they had collected the data to monitor the condition of the fleet, to locate the vehicle in case of theft, and to assist customers in case of an accident, among other reasons. However, the DPA found that none of these purposes justified the collection of geolocation data in such detail. For this reason, the DPA found a violation of the principle of data minimization pursuant to Art. 5 (1) c) GDPR. The DPA also found that the company had stored the vehicle data for an excessively long period of time. The data was kept for the duration of the business relationship with a customer and then for another three years after the termination of the vehicle rental. In addition, personal data of users who had been inactive for more than eight years were still stored in the company's databases. The CNIL found that this long retention constituted a violation of Art. 5 (1) e) GDPR. Finally, the DPA found that users were not adequately informed during the registration process on the company portal, and that the company thus violated Art. 12 GDPR.

Industry: Transportation and Energy

Original document at the source www.legifrance.gouv.fr

Similar Content