Background information
- Date of final decision: 10 November 2022
- National case
- Controller: DISCORD INC.
- Legal Reference: Data retention periods (article 5.1.e of the GDPR), Information to individuals (article 13 of the GDPR), Data protection by default (article 25.2 of the GDPR), Security of processing (article 32 of the GDPR), Data protection impact assessment (article 35 of the GDPR)
- Decision: Infringement of the GDPR, Administrative fine
- Key words: VOIP, Internet
Summary of the Decision
Origin of the case
The CNIL decided to investigate in its own initiative, without any complaints having been filed.
The CNIL conducted several types of investigation: it carried out an online check on both the "discord.com" website and the DISCORD mobile application. It also carried out a documentary investigation.
Key Findings
- Failure to define and respect a data retention period appropriate to the purpose (Article 5.1.e of the GDPR)
- Failure to comply with the obligation to provide information (Article 13 of the RGPD)
- Failure to ensure data protection by default (Article 25.2 of the GDPR)
- Failure to ensure the security of personal data (Article 32 of the GDPR)
- Failure to carry out a data protection impact assessment (Article 35 of the GDPR)
Decision
On the basis of the findings made during investigations, the restricted committee - the CNIL body responsible for issuing sanctions - considered that the company had failed to comply with several obligations under the General Data Protection Regulation (GDPR). It imposed a fine of 800,000 euros on DISCORD INC. which was made public.
The amount of the fine was decided regarding the breaches identified, the number of people concerned, but also taking into account the efforts made by the company to comply throughout the procedure and the fact that its business model is not based on the exploitation of personal data.
For further information:
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.