# COSMOSPACE: Non-compliance with general data processing principles

- Type: Enforcement
- Source: French Data Protection Authority (CNIL)
- Date: 2024-09-26
- Original: https://www.enforcementtracker.com/ETid-2616
- Canonical: https://overview.legal/posts/48731
- Topics: Controllers, Prior Consultation, IP Address, Telecommunications, Direct Marketing, Processors, Processing Agreement, Marketing, Processing, Consent

## Summary

The French DPA imposed a fine of EUR 250,000 on COSMOSPACE. The controller is a company that offers personalized clairvoyance consultations by telephone. As part of its services, the controller regularly processed multiple categories of sensitive data (Art. 9 GDPR) without obtaining prior consent. The controller also stored customer data for six years after the end of the business relationship for marketing purposes. According to the French DPA, a maximum of three years would have been admissibl

## Full text

The French DPA imposed a fine of EUR 250,000 on COSMOSPACE. The controller is a company that offers personalized clairvoyance consultations by telephone. As part of its services, the controller regularly processed multiple categories of sensitive data (Art. 9 GDPR) without obtaining prior consent. The controller also stored customer data for six years after the end of the business relationship for marketing purposes. According to the French DPA, a maximum of three years would have been admissible. This resulted in a fine of EUR 200,000. The fine was increased by EUR 50,000 because the processor also infringed the French Post and Electronic Communications Code.

GDPR Articles: Art. 5 (1) c), e) GDPR, Art. 9 GDPR
Industry: Media, Telecoms and Broadcasting

---
Generated by overview.legal · https://overview.legal/posts/48731 · 2026-08-22