Search Privacy Fines

Articles: Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. L. 34-5 CPCE

Articles: Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 32 GDPR, L. 34-5 CPCE

Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPR

Articles: Art. 5 (1) e) GDPR, Art. 13 GDPR, Art. 17 GDPR, Art. 32 GDPR, Art. 82 Loi informatique et libertés, Art. L. 34-5 CPCE

Futura Internationale was fined because after several individuals have complained that they were cold-called by the company even after they have expressly requested not to be called again. The reason why the fine was so high relative to similar cases and fines was that the CNIL determined that the company had received a large number of letters requesting to be taken off from the call lists but decided to ignore them. More so, Futura Internationale was found to store excessive information about customers and their health data. The company did also not inform their customers about the processing of their personal data and that all telephone conversations were recorded.

Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPR

Articles: Art. 14 GDPR, Art. 28 GDPR

The company was fined because of two reasons – the complete lack of security measures, and excessive data storage. Regarding the former reason, personal data, including health cards, IDs, divorce judgments, and account statements were available online with no authentication procedure. Moreover, the company breached the data storage deadline it had in place and kept clients’ data for more than it should have.

Articles: Art. 32 GDPR

Articles: Art. 5 (1) c) GDPR, Art. 5 (1) e) GDPR, Art. 5 (2) GDPR, Art. 32 GDPR

Articles: Art. 32 GDPR

Articles: Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 32 GDPR, Art. 33 GDPR

Articles: Art. 12 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 25 GDPR, Art. 32 GDPR

Articles: Art. 5 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR

Articles: Art. 5 (1) e) GDPR, Art. 32 GDPR

Articles: Art. 32 GDPR

The company had allowed for personal data belonging to clients (including copies of the driver’s license) to be publicized online. Apparently, unauthorized access was detected, and the fault lies with the inappropriate security measures.

Articles: Art. 32 GDPR

Articles: Art. 28 GDPR, Art. 32 GDPR, Art. 34 GDPR

Articles: Art. 5 (1) c) GDPR, Art. 12 GDPR

Articles: Art. 32 GDPR

Articles: Art. 5 (1) c) GDPR, Art. 28 (3) GDPR, Art. 82 Loi informatique et libertés

Articles: Art. 32 GDPR

Articles: Art. 5 (1) c)

Articles: Art. 12 GDPR, Art. 13 GDPR

Articles: Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR

Complaints from the employees were received that they were unlawfully filmed in the workspace. The company failed to observe the rules pertaining to the unlawful filming of employees all the time, and the necessity of providing information related to the data processing to the employees. The CNIL performed an audit in October 2018, and the company wasn’t observing the data protection laws. Therefore, fines were issued.

Articles: Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR

Articles: Art. 5 (1) c), e) GDPR, Art. 14 GDPR, Art. 21 GDPR, Art. 28 GDPR, Art. L34-5 CPCE