French SA fines Cityscoot 125 000€

29 March 2023

Background information

  • Date of final decision: March 16th , 2023
  • Cross-border case or national case: Cross-border case
  • LSA: France
  • CSAs: Spain, Italy
  • Controller: Cityscoot      
  • Legal Reference: Data minimisation (article 5.1.c of the GDPR), Contractual framework between the controller and processors (article 28.3 of the GDPR), Inform and collect user consent before writing and reading information on electronic devices (article 82 of the French Data Protection Act)
  • Decision: Infringement of the GDPR, Infringement of the French Data Protection Act, Administrative fine 
  • Key words: Data minimisation, Data processors

 

Summary of the Decision

 

Origin of the case

In 2020, the CNIL partly focused its investigations on several priority thematic areas related to the everyday concerns of the French, including geolocation for local services. In this context, the CNIL carried out investigations on the company CITYSCOOT, which rents scooters for a short period.

 

Key Findings

  • Failure to comply with the obligation to ensure data minimisation (Article 5.1.c of the GDPR)
  • Failure to comply with the obligation to provide a contractual framework for the processing operations carried out by a processor (Article 28.3 of the GDPR)
  • Failure to inform the user and obtain his or her consent before writing and reading information on his or her personal device (Article 82 of the French Data Protection Act)

 

Decision

On the basis of these findings, the restricted committee – the CNIL's body responsible for issuing sanctions – imposed a fine of €125,000 on CITYSCOOT, which was made public. This decision was taken in cooperation with the Spanish and Italian data protection authorities, as CITYSCOOT also offers these services in these countries.

For further information:

 

The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.