- Enforcing jurisdiction
- France · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
GIE INFOGREFFE – €250,000 Fine (France, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
GIE INFOGREFFE was fined €250,000 for keeping personal data longer than allowed and for not using secure passwords. This matters because it shows that companies must protect personal information and follow data protection rules. The case highlights the importance of proper data management and security measures.
What happened
GIE INFOGREFFE kept personal data of 25% of its members for longer than 36 months and failed to implement secure password measures.
Who was affected
Members and subscribers of GIE INFOGREFFE whose personal data, including bank details and contact information, were improperly stored.
What the authority found
The French data protection authority ruled that GIE INFOGREFFE violated GDPR by not adequately protecting personal data and retaining it longer than necessary.
Why this matters
This ruling emphasizes that companies must have strong data protection practices in place. It serves as a warning for other businesses to review their data retention and security policies.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 10 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The French DPA has imposed a fine of EUR 250,000 on GIE INFOGREFFE. The portal operates a website where people can access legal information about companies and order documents certified by the commercial courts. As part of its investigation, the DPA found that the personal data of 25% of members and subscribers, such as bank details, surnames, first names, addresses and telephone numbers, were kept for longer than intended (36 months). The DPA considered this to be a violation of Art. 5 (1) e) GDPR. In addition, the DPA found that the portal did not require the use of a secure password when creating an account, resulting in 3.7 million accounts not having a sufficiently secure password. Furthermore, the portal transmitted passwords that allowed access to accounts unencrypted via email. Besides, the portal also stored the passwords and secret questions and answers used during the process of resetting passwords by users in a database without encryption. For this reason, the DPA found that the portal had failed to implement adequate technical and organizational measures to protect personal data.
Related Enforcement Actions (1)
Other enforcement actions involving GIE INFOGREFFE in FR
Details
Fine Date
13 September 2022
Authority
Commission Nationale de l'Informatique et des Libertés
Fine Amount
€250,000
Enforcement Tracker ID
ETid-1382
About this data
Cite as: Cookie Fines. GIE INFOGREFFE - France (2022). Retrieved from cookiefines.eu
Last updated: