# Company: Non-compliance with general data processing principles

- Type: Enforcement
- Source: French Data Protection Authority (CNIL)
- Date: 2025-12-30
- Original: https://www.enforcementtracker.com/ETid-2998
- Canonical: https://overview.legal/posts/52352
- Topics: DPIA, IP Address, Processing Agreement, Controllers, Privacy Impact Assessment, Direct Marketing, Processing, International Transfer, Personal Data, Human Resources

## Summary

The French DPA has imposed a fine of EUR 3,500,000 on a company. The controller operated a loyalty program in France and 16 other EU countries, using customer data obtained through the program to transfer it to a third party for marketing purposes. The controller had no sufficient legal basis for this transfer and also failed to inform the data subjects. Furthermore, the controller used an inadequate method to store passwords. Finally, the controller failed to conduct a data protection impact as

## Full text

The French DPA has imposed a fine of EUR 3,500,000 on a company. The controller operated a loyalty program in France and 16 other EU countries, using customer data obtained through the program to transfer it to a third party for marketing purposes. The controller had no sufficient legal basis for this transfer and also failed to inform the data subjects. Furthermore, the controller used an inadequate method to store passwords. Finally, the controller failed to conduct a data protection impact assessment, which would have been mandatory given the amount of data being processed and the cross-referencing of data.

GDPR Articles: Art. 6 (1) a) GDPR, Art. 13 GDPR, Art. 32 GDPR, Art. 35 GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/52352 · 2026-08-22