Enforcement · French Data Protection Authority (CNIL) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

ÉLECTRICITÉ DE FRANCE: Insufficient fulfilment of data subjects rights

The French DPA has imposed a fine of EUR 600,000 on ÉLECTRICITÉ DE FRANCE (EDF), France's largest electricity supplier.

€600,000 Fine
ÉLECTRICITÉ DE FRANCE
FRANCE
Art. 7 GDPR Art. 12 GDPR Art. 13 GDPR Art. 14 GDPR Art. 15 GDPR Art. 21 GDPR
Right to Object Personal Data Direct Marketing Supervisory Authorities Consent
Nov 24, 2022 Source legifrance.gouv.fr

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline
§

The French DPA has imposed a fine of EUR 600,000 on ÉLECTRICITÉ DE FRANCE (EDF), France's largest electricity supplier. The DPA had received several complaints that individuals were experiencing difficulties in exercising their rights by EDF. During its investigation, the DPA found that EDF's privacy policy did not provide sufficient information on various aspects of data processing, such as the retention period of personal data. In addition, the DPA found that EDF had not responded to a number of data subject requests in a timely manner Also, EDF failed to respect data subjects' right to object to advertising requests in some cases. Furthermore, the DPA noted that EDF failed to demonstrate that it had obtained valid consent from data subjects in the context of a commercial solicitation campaign. Finally, the DPA concluded that EDF had failed to implement sufficient technical and organizational measures to protect personal data.

Right to Object Personal Data Retention Period
§

EDF had insecurely stored passwords of more than 25,000 customer accounts. In addition, the company had merely hashed and not salted passwords of 2,4 million accounts. GDPR Articles: Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. L. 34-5 CPCE Industry: Transportation and Energy

applies Art. 7Art. 12Art. 13Art. 14

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 6

Related across sources

C-741/21 GP v juris GmbH In Case C-741/21, the Court of Justice of the European Union (Third Chamber) addressed a preliminary reference from the Landgericht Saarbrücken in proceedings between data subject… CJEU ·Third Chamber Apr 11, 2024 Liability Personal Data Integrity and Confidentiality Principle
HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). ·CJEU Jan 9, 2025 IP Address Retention Period Identification
C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data
2022 EDPB Annual Report 2021 Enhancing the depth and breadth of data protection 2 EDPB Annual Report 2021 2 ENHANCING THE DEPTH AND BREADTH OF DATA PROTECTION An Executive Summary of this report, which… May 12, 2022 Privacy Shield Processing Agreement International Transfer
Guidelines 10/2020 restrictions under Article 23 GDPR Guidelines ·EDPB Oct 13, 2021 GDPR Subject-Matter and Objectives Right to Restriction Data Portability
Guidelines 5/2019 criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1) Guidelines ·EDPB Jul 7, 2020 Right to be Forgotten Personal Data Right to Rectification
Related documents