Background information
- Date of final decision: 29 December 2023
- Cross-border case
- LSA: France
- and CSAs: Germany, Austria, Belgium, Cyprus, Denmark, Spain, Finland, Greece, Ireland, Italy, Luxemburg, Netherlands, Norway, Poland, Portugal, Romanie, Sweden
- Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject), Article 32 (Security of processing)
- Decision: Administrative fine
- Key words: Cookies, Data retention, E-Commerce
Summary of the Decision
Origin of the case
NS CARDS FRANCE is a company that publishes the neosurf.com website and the "Neosurf" mobile application that allows to pay online after registering with the service.
At the end of 2021, the CNIL, French Supervisory Authority (SA) carried out two investigations on the company. It found breaches concerning the time user account data was kept, the information provided to individuals, the security of data and the methods for depositing cookies and tracers on users' terminals.
Key Findings
The French SA found several breaches of the GDPR:
- Failure to comply with the obligation to retain data for a period limited to the purpose for which it was collected (article 5.1.e of the GDPR)
- Failure to comply with the obligation to inform individuals (Articles 12 and 13 of the GDPR)
- Failure to comply with the obligation to ensure the security of personal data (Article 32 of the GDPR)
And one breach to the French Data Protection Act: a failure to comply with obligations relating to the use of cookies and trackers (article 82)
Decision
The French SA imposed a fine of EUR 105,000 euros on NS CARDS FRANCE.
For further information:
• Paiement électronique : la CNIL inflige une amende de 105 000 euros à NS CARDS FRANCE (FR)
• Electronic payment: CNIL fined NS CARDS FRANCE €105,000
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.