Background information
- Date of final decision: 23 June 2022
- Cross-border case or national case: National case
- Controller: TotalEnergies Électricité et Gaz France
- Legal Reference:
GDPR: Right of access (Article 15), Right to object (Article 21), Information to be provided where personal data have not been obtained from the data subject (Article 14), Information, communication and modalities for the exercise of rights (Article 12).
French Postal and Electronic Communications Code (CPCE): Right to object to the reuse of personal data for commercial prospection (Article L.34-5). - Decision: Infringement of the GDPR, infringement of the French Postal and Electronic Communications Code, Administrative fine
- Key words: Commercial prospection
Summary of the Decision
Origin of the case
The French Supervisory Authority (SA), CNIL (Commission nationale de l'informatique et des libertés) has received several complaints concerning the difficulties encountered by individuals in having their requests for access to their data and opposition to receiving calls for the purposes of direct marketing taken into account by the French energy producer and supplier, TotalEnergies Électricité et Gaz France.
Key Findings
French Postal and Electronic Communications Code: Failure to allow individuals to object to commercial prospecting.
By filling in a webform for subscribing to an emerging contract, the user had no means of objecting to the re-use of their data for the purposes of commercial canvassing for similar products or services, which is contrary to the French texts (article L. 34-5 of the French Post and Electronic Communications Code or CPCE). GDPR:
- Failure to comply with the obligation to inform individuals solicited (article 14 of the GDPR).
- Failure to respect the right of access to data (article 15 GDPR) and the right to object of data subjects (article 21 GDPR).
- Failure to comply with the obligations relating to the modalities for exercising rights (Article 12 of the GDPR).
Decision
On the basis of the findings made during the investigations, the restricted committee - the CNIL's body in charge of imposing sanctions - issued a fine of 1 million euros against TotalEnergies Électricité et Gaz France and decided to make it public.
The amount of this fine was decided in the light of the breaches identified as well as all the measures taken by the company during the procedure to bring itself into compliance.
For further information:
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.