De Particulier à Particulier - Editions Neressis – €100,000 Fine (France, 2024)

Société Particulier à Particulier - Editions Neressis ("controller") provides individuals with a set of publications and services allowing them to conclude real estate transactions without intermediaries. The CNIL conducted an online investigation of their website, www.pap.fr, to verify the methods of informing people about their rights as data subjects, and whether the procedure for creating a user account was sufficiently secure and confidential. The on-site investigation focused on the verification of the retention periods applied to user account data, the legality of data processor agreements in place and the technical and organizational measures to ensure the security of the data collected through the website. During its investigations, the CNIL found that the controller defined a systematic retention period of ten years from the acceptance of an order on the website. The CNIL also discovered that the controller did not include the right to lodge a complaint with the DPA, the legal basis for each processing as well as the recipients and categories of recipients in their privacy policy. The CNIL initiated a sanctioning procedure against the controller on 6 February 2023. Firstly, regarding the retention periods, the CNIL considered that a retention period of ten years from the date of acceptance of the order was justified by its legal obligations resulting from French law, in particular [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032226994/ Articles L.213-1], [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032807208 D.213-1] and [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032807210 D.213-2] Consumer Code, for contracts worth more than €120. Therefore, the CNIL considered that for contracts that were less than €120, the 10 year retention period was excessive and therefore breaches Article 5(1)(e) GDPR. Additionally, while the CNIL agreed that a 5 year retention period commencing from the date of last connection to