Enforcement · French Data Protection Authority (CNIL) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

GIE INFOGREFFE: Insufficient technical and organisational measures to ensure information security

€250,000 Fine
GIE INFOGREFFE
FRANCE
Art. 5 GDPR Art. 32 GDPR
Encryption Security Personal Data Public Authority Education Privacy by Design & Default Public Sector Processing Agreement
Sep 13, 2022 Source

How it connects

Related across sources

News What Happened to the Risk-Based Approach to Data Transfers? Future of Privacy Forum News UK data protection reform: How the UK's GDPR may change Hogan Lovells News Hervorming van de privacywetgeving in het Verenigd Koninkrijk: Hoe de GDPR van het VK mogelijk zal veranderen. Hogan Lovells Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Guidance Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 EDPB

Full text

The French DPA has imposed a fine of EUR 250,000 on GIE INFOGREFFE. The portal operates a website where people can access legal information about companies and order documents certified by the commercial courts. As part of its investigation, the DPA found that the personal data of 25% of members and subscribers, such as bank details, surnames, first names, addresses and telephone numbers, were kept for longer than intended (36 months). The DPA considered this to be a violation of Art. 5 (1) e) GDPR. In addition, the DPA found that the portal did not require the use of a secure password when creating an account, resulting in 3.7 million accounts not having a sufficiently secure password. Furthermore, the portal transmitted passwords that allowed access to accounts unencrypted via email. Besides, the portal also stored the passwords and secret questions and answers used during the process of resetting passwords by users in a database without encryption. For this reason, the DPA found that the portal had failed to implement adequate technical and organizational measures to protect personal data.

Industry: Public Sector and Education

Original document at the source www.cnil.fr

Similar Content