GIE INFOGREFFE – €250,000 Fine (France, 2022)

GIE INFOGREFFE (controller) has a website which allows consultation of legal information on companies. This website also provides the possibility to order certain documents. In its "Confidentiality Charter" on its website, the controller made a distinction between two kinds of users: "members" and "subscribers". "Members" were users who could order a selected paid service on the website, for which they needed an account. "Subscribers" were users who had subscribed to an annual subscription of the website. A data subject filed a complaint at the DPA stating that he was able to get a password on the phone only by telling his name. The data subject also complained that the website stored user passwords in plain text. The DPA started an investigation into the website of the controller. On its website, the controller had stated in the "Confidentiality Charter" that the personal data of members and subscribers were kept for 36 months after the last order from a customer requesting service or documents. The DPA found in its investigation that no procedure for the automatic deletion of personal data was used by the controller and that personal data was kept for excessive periods of time in relation to the respective purpose and the own policy set by the controller. The controller admitted that personal data had been kept for longer than 36 months but stated that for purposes such as 'collection operations', it would be justified for certain data to be stored for a longer period of time. With regard to the manual anonymization of personal data upon requests of users, the controller admitted that 25% of accounts were kept for more than 36 months after the last order, formality or invoice, without being anonymized. The was also no automatic anonymization procedure implemented by the controller. The DPA held that the controller violated Article 5(1)(e) GDPR because personal data was kept for more than 36 months. First, the DPA held that purpose and the deletion period stated by the controller could only concern the personal data of "subscribers" and not of "members", because "members" were paying immediately for a service or document. The DPA also held that some purposes were not identified by the controller, such as the purpose to provide a document for "members", accounting purposes and tax purposes. The DPA held the retention of data could appear justified for the purposes of providing documents, accounting and tax purposes. However, according to the DPA, when relevant personal data had to be retained longer than the retention period, some extra measures needed to be implemented. The data had to be stored in a temporary separate storage location, for example in a dedicated archive database or in a separate part of an existing database. This data shouldn't be kept for a longer period then what's necessary for the respective purposes of the controller. The DPA also held that only authorized people should have access to this data. None of these described measures were implemented by the controller in this case. The DPA also found that the manual anonymization procedure at the request of users concerned a small number of accounts. Anonymization was not implemented for 25% of accounts where this should have been the case. The DPA also held that no automatic anonymization procedure was implemented by the controller. Therefore, the controller was able to keep identifying data without any time limit. Because of these facts, the DPA held that Article 5(1)(e) GDPR had been breached, despite the fact that the controller had deleted inactive user-accounts during the procedure. The DPA also held that article 32 GDPR was violated because of several security problems. The DPA discovered that the controller stored passwords in plain text in a database. Furthermore, users were not allowed to create a password of more than 8 characters, without any complexity requirements and other security measures. Passwords were also transmitted in plain text during email conversations with users. Finally, users were not warned when their password was being changed, thus not ensuring a safe level security protecting against identity theft. Considering the high number of users (3.7 million) and the sensitivity of the data concerned (bank related, name, address, phone numbers etc.) the CNIL considered the infringement as 'serious' and enforced a €250,000 fine.