Content type · 103 documents in this view · 3,811 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: France (50) Clear filter
Filter by Topic Supervisory Authorities 3587 Processing 2635 Personal Data 2394 Controllers 2017 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€20,000 Pharmaceutical wholesaler: €20,000 fine The French DPA has imposed a fine of EUR 20,000 on a pharmaceutical wholesaler due to violations of several regulations, including a lack of data security and insufficient… FRANCE · ·Unknown Jan 24, 2024
€32M AMAZON FRANCE LOGISTIQUE: Non-compliance with general data processing principles The French DPA (CNIL) has imposed a fine of EUR 32 million on AMAZON FRANCE LOGISTIQUE for unlawful surveillance of employees. CNIL found that Amazon France equips its warehouse… ·Art. 5, 6, 12 +2 ·Non-compliance with general data processing principles Jan 23, 2024
€500 Attorney: Insufficient cooperation with supervisory authority The French DPA has imposed a fine of EUR 500 on an attorney. The fine was imposed due to a lack of cooperation with the DPA. FRANCE · ·Insufficient cooperation with supervisory authority Jan 22, 2024
€5,000 Attorney: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 5000 on an attorney. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of a request of erasure of… FRANCE · ·Insufficient fulfilment of data subjects rights Jan 15, 2024
€1,500 Website operator: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 1,500 on a website operator. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of data subject… FRANCE · ·Insufficient fulfilment of data subjects rights Jan 9, 2024
Municipality: Non-compliance with general data processing principles Fine against municipality for lack of security measures (insufficient passwords) FRANCE · ·Non-compliance with general data processing principles Dec 22, 2023
Company: Non-compliance with general data processing principles The French DPA has imposed a fine on a company. The controller had collected data from applicants, even though the processing of the specific data was not necessary for the job… FRANCE · ·Art. 5 Dec 22, 2023
Candidate for parliamentary elections: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine on a candidate for parliamentary elections. The candidate had sent the data subject election advertising by email despite the data subject's… FRANCE · ·Art. 21 Dec 22, 2023
FRANCE DPA: Insufficient cooperation with supervisory authority The French DPA has imposed a fine on a data controller for lack of cooperation. ·Insufficient cooperation with supervisory authority Dec 22, 2023
€5,000 Kourou municipality: Insufficient cooperation with supervisory authority The French DPA has imposed a fine of EUR 5,000 on Kourou municipality for failing to appoint a data protection officer and to sufficiently cooperate with the DPA. FRANCE · ·Art. 31, 37 Dec 12, 2023
€600,000 GROUPE CANAL +: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 600,000 on GROUPE CANAL+ for multiple violations of the GDPR. The DPA determined that the data controller failed to demonstrate that it… FRANCE · ·Art. 7, 12, 13 +5 Oct 12, 2023
€200,000 SAF LOGISTICS: Non-compliance with general data processing principles The French DPA has fined SAF LOGISTICS EUR 200,000. An employee reported to the DPA that the controller had collected data on the private lives of its employees. During its… FRANCE · ·Art. 5, 9, 10 +1 Sep 18, 2023
€90M CNIL closes Google cookies enforcement after SAN-2021-023 compliance This decision follows from a previous decision of the French DPA (SAN 2021-023 of 31 December 2021), in which said DPA fined Google LLC €90,000,000 and Google Ireland Limited… France ·Art. 5, 82 Jul 13, 2023
€150,000 KG COM: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 150,000 on the company KG COM. The company operates several websites and offers fortune-telling consultations to customers via chat or… FRANCE · ·Art. 5, 6, 9 +6 Jun 8, 2023
€5.2M Clearview AI: Insufficient cooperation with supervisory authority The French DPA has fined Clearview AI EUR 5.2 million. The DPA had imposed a fine of EUR 20 million on the company in 2022 for unlawfully collecting personal data. In addition to… FRANCE · ·Insufficient cooperation with supervisory authority May 10, 2023
€125,000 CITYSCOOT: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 125,000 on CITYSCOOT, a company that rents out motor scooters for short periods. During its investigation, the DPA found that CITYSCOOT,… FRANCE · ·Art. 5, 28, 82 Mar 16, 2023
€3M VOODOO ('provider') was a mobile game developer The investigation service of the French DPA (the investigation service) carried out several checks on voodoo.io and on several of the provider's mobile applications on iOS, in… SAN-2022-026 ·France · Dec 29, 2022
€300,000 FREE SAS: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 300,000 on FREE SAS. The DPA had received several complaints from individuals experiencing difficulties in exercising their rights to… FRANCE · ·Art. 12, 15, 17 +2 Dec 8, 2022
€600,000 ÉLECTRICITÉ DE FRANCE: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 600,000 on ÉLECTRICITÉ DE FRANCE (EDF), France's largest electricity supplier. The DPA had received several complaints that individuals… ·Art. 7, 12, 13 +3 ·Insufficient fulfilment of data subjects rights Nov 24, 2022
€800,000 DISCORD INC.: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 800,000 on DISCORD INC.. DISCORD offers an online communication service through which users can chat or make video calls. During its… FRANCE · ·Art. 5, 13, 25 +2 Nov 10, 2022
€20M Clearview Al Inc.: Insufficient fulfilment of data subjects rights The French DPA has fined Clearview Al Inc. EUR 20,000,000. The company holds a database of more than 20 billion facial images (including those of french residents and nationals)… FRANCE · ·Art. 6, 12, 15 +2 Oct 17, 2022
€250,000 GIE INFOGREFFE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 250,000 on GIE INFOGREFFE. The portal operates a website where people can access legal information about companies and order documents… FRANCE · ·Art. 5, 32 Sep 13, 2022
€600,000 ACCOR SA: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has imposed a fine of EUR 600,000 on ACCOR SA. Both CNIL and other European DPAS had received complaints against ACCOR from several individuals. In the… FRANCE · ·Art. 12, 13, 15 +2 Aug 19, 2022
€175,000 UBEEQO INTERNATIONAL: Non-compliance with general data processing principles The French DPA (CNIL) has fined the company UBEEQO INTERNATIONAL EUR 175,000. The vehicle rental company had collected geolocation data on rented vehicles at every 500 meters. The… FRANCE · ·Art. 5, 12 Jul 7, 2022
€1M TotalEnergies Electricité et Gaz France: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 1,000,000 on TotalEnergies Electricité et Gaz France. As part of its investigation, the DPA found that the controller had violated its… ·Art. 14, 15, 21 ·Insufficient fulfilment of data subjects rights Jun 23, 2022
€1.5M DEDALUS BIOLOGIE: Insufficient technical and organisational measures to ensure information security The French DPA (CNIL) has imposed a fine of EUR 1.5 million on DEDALUS BIOLOGIE. DEDALUS distributes software solutions for medical analysis laboratories. In February, the press… FRANCE · ·Art. 28, 29, 32 Apr 15, 2022
€60M Google Ireland Ltd.: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 60,000,000 on Google Ireland Ltd. The CNIL received several complaints regarding the manner in which cookies… FRANCE · ·Art. 82 Dec 31, 2021
€90M Google LLC: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 90,000,000 on GOOGLE LLC. The CNIL received several complaints regarding the manner in which cookies could be… FRANCE · ·Art. 82 Dec 31, 2021
€60M Facebook Ireland Ltd.: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 60,000,000 on Facebook Ireland Ltd. The CNIL received several complaints regarding the manner in which cookies… FRANCE · ·Art. 82 Dec 31, 2021
€150M Google LLC is a subsidiary owned wholly by Alphabet Inc Google Ireland Limited ('GIL') "presents itself" as the headquarters for the Google group's operations in the EEA and Switzerland. In March 2020 the French DPA (CNIL) carried out… SAN-2021-023 ·France · Dec 31, 2021
€180,000 SLIMPAY: Insufficient technical and organisational measures to ensure information security The French DPA (CNIL) has imposed a fine of EUR 180,000 on the payment institution SLIMPAY. In 2015, SLIMPAY conducted an internal research project in which it processed personal… FRANCE · ·Art. 28, 32, 34 Dec 28, 2021
€300,000 FREE MOBILE: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has imposed a fine of EUR 300,000 on FREEE MOBILE. The CNIL had received numerous complaints regarding the company's failure to comply with data subjects'… FRANCE · ·Art. 12, 15, 21 +2 Dec 28, 2021
€400,000 Régie autonome des transports parisiens: Non-compliance with general data processing principles The French DPA (CNIL) imposed a fine of EUR 400,000 on RATP (the operator of the public transport system in Paris). In May 2020, a trade union filed a complaint with the CNIL… FRANCE · ·Art. 5, 32 Nov 4, 2021
€3,000 Société nouvelle de l’annuaire français: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has fined Société nouvelle de l'annuaire français (SNAF) EUR 3,000. SNAF operates the website annuairefrancais.fr, which lists French companies based on data… FRANCE · ·Art. 16, 17, 30 +1 Sep 15, 2021
€400,000 Monsanto Company: Insufficient fulfilment of information obligations The French DPA (CNIL) has fined MONSANTO EUR 400,000. In May 2019, several media revealed that MONSANTO was in possession of a file containing the personal data of more than 200… FRANCE · ·Art. 14, 28 Jul 26, 2021
€1.8M SGAM AG2R LA MONDIALE: Non-compliance with general data processing principles The French DPA (CNIL) has fined private insurer SGAM AG2R LA MONDIALE EUR 1,750,000. The CNIL had carried out an inspection at the AG2R LA MONDIALE group in 2019. On this… FRANCE · ·Art. 5, 13, 14 Jul 20, 2021
€500,000 BRICO PRIVÉ: Non-compliance with general data processing principles The French DPA (CNIL) has imposed a fine of EUR 500,000 on BRICO PRIVÉ. CNIL conducted three inspections at BRICO PRIVÉ between 2018 and 2021 and identified several deficiencies… FRANCE · ·Art. 5, 13, 17 +2 Jun 14, 2021
€100M CNIL closes Google cookies case after accepting compliance adjustments On 7 December 2020, the CNIL fined Google €100,000,000 for not complying with the cookies regulation. The CNIL had also given Google a limited time to adapt their cookies settings… France ·Art. 7 Apr 30, 2021
€150,000 FRANCE DPA: Insufficient technical and organisational measures to ensure information security The French DPA (CNIL) fined a company and its subcontractor EUR 150,000 and EUR 75,000 for failing to take sufficient measures against credential stuffing attacks on the company's… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 27, 2021
€75,000 FRANCE DPA: Insufficient technical and organisational measures to ensure information security The French DPA (CNIL) fined a company and its subcontractor EUR 150,000 and EUR 75,000 for failing to take sufficient measures against credential stuffing attacks on the company's… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 27, 2021
€20,000 Nestor SAS: Insufficient fulfilment of information obligations The French DPA (CNIL) fined the company Nestor EUR 20,000. The CNIL notes that the privacy policy provided during the registration process on the company´s website did not contain… FRANCE · ·Art. 12, 13 Jan 5, 2021
€6,000 Doctor: Insufficient technical and organisational measures to ensure information security The French DPA (CNIL) fined a doctor EUR 6,000 for violations of Art. 32 GDPR and Art. 33 GDPR. The controller had stored medical image data such as MRI and X-ray images as well… FRANCE · ·Art. 32, 33 Dec 17, 2020
€3,000 Doctor: Insufficient technical and organisational measures to ensure information security The French DPA (CNIL) fined a doctor EUR 3,000 for violations of Art. 32 GDPR and Art. 33 GDPR. The controller had stored medical image data as MRI and X-ray images as well as… FRANCE · ·Art. 32, 33 Dec 17, 2020
€7,300 Perfomeclic: Insufficient legal basis for data processing The French DPA (CNIL) imposed a fine of EUR 7,300 on the company Perfomeclic. The company had sent commercial advertising emails without a proof of prior consent and without… FRANCE · ·Art. 5, 14, 21 +1 Dec 7, 2020
€35M CNIL · SAN-2020-013 Between December 2019 and May 2020, the CNIL conducted three online and one on-site investigations on Amazon Europe Core (AEC), a subsidiary company of the Amazon group operating… France ·Art. 6, 9, 83 +1 Dec 7, 2020
€800,000 Carrefour Banque: Non-compliance with general data processing principles The French DPA (CNIL) imposed a fine on Carrefour Banque for violation of its obligation to process data fairly (Article 5 (1) GDPR). If a person who subscribed to the Pass card… FRANCE · ·Art. 5 Nov 18, 2020
€2.3M Carrefour France: Non-compliance with general data processing principles The French DPA (CNIL) fined Carrefour France EUR 2,250,000 for several violations of data protection regulations, including the GPDR. During its investigation, the CNIL found that… ·Art. 5, 12, 13 +5 ·Non-compliance with general data processing principles Nov 18, 2020
€250,000 Spartoo: Non-compliance with general data processing principles A fine of EUR 250000 was imposed on the online retailer Spartoo. The reason for this was that the company, which has its headquarters in France but supplies a large number of… FRANCE · ·Art. 5, 13, 14 Aug 5, 2020
€500,000 Futura Internationale: Insufficient fulfilment of data subjects rights Futura Internationale was fined for cold calls after several complainants obtained cold calls, despite having declared directly to the caller and by post that this was not wanted.… FRANCE · ·Art. 5, 6, 13 +4 Nov 21, 2019
€180,000 ACTIVE ASSURANCES (car insurer): Insufficient technical and organisational measures to ensure information security Large amount of customer accounts, clients' documents (including copies of driver's licences, vehicle registration, bank statements and documents to determine whether a person had… FRANCE · ·Art. 32 Jul 25, 2019