Background information
- Date of decision: 18 September 2023
- Cross-border case or national case: National case
- Legal references: Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 10 (Processing of data relating to criminal convictions and offences), Article 31 (Co-operation with the supervisory authority)
- Decision: Administrative fine
- Key words: Cooperation with the supervisory authority, Data minimisation, Sensitive data
Summary of the Decision
Origin of the case
SAF LOGITICS is an air freight company whose parent company is located in China. An employee reported to the CNIL that SAF LOGISTICS collected data relating to its employees' private lives, as part of an internal recruitment for a position in the parent company. Therefore, the CNIL carried out an onsite investigation in order to verify the legality of the form used for the collection of data.
Key Findings
The French SA has found several breaches of the GDPR:
- Infringement of the data minimisation (Article 5(1)(c) of the GDPR)
- Infringement of the ban on processing sensitive data (Article 9 of the GDPR)
- A breach of the ban on processing personal data relating to criminal convictions and offences and related security measures (Article 10 of the GDPR)
- Infringement of the obligation to cooperate with the supervisory authority (Article 31 of the GDPR)
Decision
The French SA imposed a fine of EUR 200,000 euros on SAF LOGISTICS.
For further information:
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.