Enforcement · French Data Protection Authority (CNIL) EN LLM context

KG COM: Non-compliance with general data processing principles

The French DPA has imposed a fine of EUR 150,000 on the company KG COM.

€150,000 Fine

KG COM

FRANCE

Art. 5 GDPR Art. 6 GDPR Art. 9 GDPR Art. 12 GDPR Art. 13 GDPR Art. 28 GDPR Art. 32 GDPR Art. 33 GDPR Art. 82 GDPR

Data Breaches Legitimate Interest Controllers Personal Data Security

Jun 8, 2023 Source cnil.fr

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The French DPA has imposed a fine of EUR 150,000 on the company KG COM. The company operates several websites and offers fortune-telling consultations to customers via chat or telephone. After the company suffered a data breach, the DPA conducted three investigations. During its investigation, the DPA found that the controller systematically recorded conversations with customers as well as potential customers without properly justifying why such extensive recording was necessary. In addition, the controller stored banking information of its customers for the purposes of conducting transactions and combating fraud, as well as to facilitate customers' purchase of further fortune-telling consultations. The DPA found that a legitimate interest of the controller could be affirmed for the storage of bank data for the purpose of fraud prevention, but not for the storage regarding further purchases.

Legitimate Interest Data Breaches Controllers

The DPA also found that the controller processed data on the health status as well as the sexual orientation of its customers without their explicit consent; implied consent through use of the consultations was not considered sufficient. In addition, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data. The controller did not, for example, provide sufficiently robust passwords for the user accounts, which exposed the data to the risk of computer attacks. Finally, the DPA found that the controller failed to report a data leak to the DPA. GDPR Articles: Art. 5 (1) c), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 82 Loi informatique et libertés Industry: Finance, Insurance and Consulting

Personal Data Security Controllers applies Art. 5(1)Art. 6 Art. 9 Art. 12

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 10

Related across sources

C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer

Guidelines 4/2019 Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines on data protection by design and by default Guidelines ·EDPB Oct 20, 2020 Privacy by Design & Default Privacy by Default Privacy by Design

C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) CJEU Jan 12, 2023 Supervisory Authorities IP Address Supervision

C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data

Guidelines 3/2019 processing of personal data through video devices Guidelines ·EDPB Jan 30, 2020 Personal Data Processing Material scope (GDPR)