De Particulier à Particulier - Editions Neressis – €100,000 Fine (France, 2024)

Société Particulier à Particulier - Editions Neressis ("controller") provides individuals with a set of publications and services allowing them to conclude real estate transactions without intermediaries. The CNIL conducted an online investigation of their website, www.pap.fr, to verify the methods of informing people about their rights as data subjects, and whether the procedure for creating a user account was sufficiently secure and confidential. The on-site investigation focused on the verification of the retention periods applied to user account data, the legality of data processor agreements in place and the technical and organizational measures to ensure the security of the data collected through the website. During its investigations, the CNIL found that the controller defined a systematic retention period of ten years from the acceptance of an order on the website. The CNIL also discovered that the controller did not include the right to lodge a complaint with the DPA, the legal basis for each processing as well as the recipients and categories of recipients in their privacy policy. The CNIL initiated a sanctioning procedure against the controller on 6 February 2023. Firstly, regarding the retention periods, the CNIL considered that a retention period of ten years from the date of acceptance of the order was justified by its legal obligations resulting from French law, in particular [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032226994/ Articles L.213-1], [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032807208 D.213-1] and [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000032807210 D.213-2] Consumer Code, for contracts worth more than €120. Therefore, the CNIL considered that for contracts that were less than €120, the 10 year retention period was excessive and therefore breaches Article 5(1)(e) GDPR. Additionally, while the CNIL agreed that a 5 year retention period commencing from the date of last connection to the user account was justified for legal proceedings and anti-fraud purposes, more than 2 million user accounts of between 5 and 10 years old had been retained, as well as more than 700,000 accounts more than 10 years old. The retention of data beyond what was necessary for the announced purpose constituted a breach of Article 5(1)(e) GDPR. Secondly, the CNIL indicated that the controller breached Article 13 GDPR by failing to include the right to lodge a complaint to the CNIL, together with inaccurate data retention period information, in the privacy policy. The CNIL noted that this information helps users to control the processing of their data, and thereby ensures fair and transparent processing. Thirdly, the CNIL found that the controller had breached Article 28(3) GDPR where it had tried to retroactively amend one of its data processor agreements to include all requirements of this Article. The CNIL held that the retroactive nature of the amendment cannot cover the breach for the past. Finally, the CNIL considered that the controller breached Article 32 GDPR in several ways. Firstly, users were not required to provide strong passwords when creating an account, accounts were not locked after a certain number of failed access attempts, and part of a reference code used instead of an account (if the user did not wish to create one) was made publicly available by forming part of the ad reference number. The CNIL found that the above measures, given the current state of the art, were not sufficient to guarantee the security and confidentiality of the data being processed. Secondly, the controller failed to intermediately archive inactive customer data (kept for 10 years) and inactive user account data (kept for 5 years). The CNIL found that the mixing of inactive data in an active database, which the controller explained was for daily anti-fraud checks, did not ensure adequate data security. A large number of employees could access the data, and some of the retained data was not needed for anti-fraud checks (such as advertising details and billing addresses). For breaching Articles 5(1)(e), 13, 28 and 32 GDPR the CNIL imposed a €100,000 to the controller.