NS Cards France – €105,000 Fine (France, 2023)

In the context of its investigations, the French DPA (CNIL) undertook online and an on-the-spot checks of the controller’s website and premises. The controller, NS Cards France, is an electronic money distributor that facilitates online payments. The CNIL found that when creating a user account on the controller's website, surname, first name, date of birth, postal address, email address, telephone number, and, if applicable, bank details were collected, as well as personal documents, such as proof of identity and residence. While the controller specified a retention period of ten years for this data from the last transaction carried out on the account, in fact, no deletion had been carried out in the databases since the beginning of the controller's activity in 2005. An estimated 70,049 accounts had been inactive for more than ten years. Additionally, 51,735 accounts were kept for no purpose, as they were "unconfirmed", i.e. the email address had not been confirmed when the account was created. Furthermore, the information provided by the company on the website and its mobile application via the privacy policy was incomplete, not up-to-date and only in English. The controller also allowed users to create account passwords of six characters, composed of only three categories of characters (uppercase, lowercase and numbers), and the CNIL found that no access restrictions in the event of authentication failure were implemented. 49,214 passwords were also stored in clear text in the company's database and associated with their email address and identifier. Additionally, the rapporteur noted that thirteen cookies were deposited before any action, including consent, could be taken by the user upon arrival on the home page of the website. The Google reCaptcha module, to block robots on the registration and connection page to the website and mobile application, was also used without asking for user consent. On 10 May 2023, under Article 56 GDPR, the CNIL informed all European supervisory authorities of its competence to act as a lead supervisory authority concerning cross-border processing carried out by the controller, as even though the controller processed data of residents of other European Member States, its sole establishment was located in France. Pursuant to Article 60(3) GDPR, the draft decision was shared with the other supervisory authorities concerned. Recalling the [https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2022-018 CNIL decision No. SAN-2022-018], the CNIL noted that the retention period of personal data must be determined according to the purpose pursued by the processing. When data are no longer necessary for that purpose, they must either be deleted or subject to intermediate archiving when their retention is necessary for compliance with legal obligations, pre-litigation or contentious purposes. Beyond these retention periods, personal data must, with some exceptions, be deleted or anonymised. Therefore, the CNIL established that the controller breached Article 5(1)(e) GDPR since no deletion or anonymisation occurred of the 70,049 inactive accounts after the ten year retention period. Additionally, the CNIL noted that since the information on data processing was provided using a privacy policy only in English, despite targeting a French-speaking public, data subjects were not able to assess in advance the scope and consequences of the processing. The controller, therefore, was not complying with the transparency requirements of information set by Article 12 GDPR. Furthermore, the privacy policy did not mention the data retention period or the right to lodge a complaint with the CNIL. Given the information being processed, including bank details, this information was necessary to ensure fair and transparent processing within the meaning of Article 13(2) GDPR. Fourthly, the controller is required to ensure that the automated data processing it implements is sufficiently secure. The sufficiency of the security measures is assessed, on the one hand, with regard to the characteristics of the processing and the risks it entails and, on the other hand, taking into account the state of knowledge and the cost of the measures. Considering this, the CNIL found the controller’s password rules too permissive, leading to insufficiently robust passwords susceptible to attacks. Nor did the clear storage of users' passwords, associated with their identifiers and email address, guarantee the security and confidentiality of personal data. Hence, the CNIL found the controller to have breached Article 32 GDPR. Regarding placing cookies without user consent, the controller argued that the Google Analytics cookie was an audience measurement tool for internal use exempt from the collection of consent. However, the CNIL noted that [https://www.legifrance.gouv.fr/loda/id/LEGITEXT000006068624 Article 82 of the French Data Protection Act], the implementation of [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=EN Article 5(3) of the ePrivacy Directive], provides that operations to access or register information in a user's terminal can only take place after the latter has expressed his consent, only cookies whose exclusive purpose is to allow or facilitate communication by electronic means or those strictly necessary for the provision of an online communication service at the express request of the user being exempt from this obligation. After considering the available Google documentation, the CNIL held that the deposit of these cookies had to be subject to the user's consent. By failing to grant users a choice regarding the deposit of tracers, together with a choice about using Google ReCaptcha since its mechanism does not have the sole purpose of securing the authentication mechanism but also allows analysis operations to be carried out by Google, as specified in its terms of use, the data controller had breached [https://www.legifrance.gouv.fr/loda/id/LEGITEXT000006068624 Article 82 of the French Data Protection Act]. Considering the aforementioned violations, the CNIL issued a fine of €90,000 for breaches of Articles 5(1)(e), 12, 13 and 32 GDPR, and an additional €15,000 for the controller’s infringement of [https://www.legifrance.gouv.fr/loda/id/LEGITEXT000006068624 Article 82 of the French Data Protection Act].