CALOGA – €80,000 Fine (France, 2025)

CALOGA (the controller) is a company that carries out commercial marketing operations, as well as acting as a data broker. The controller organizes its processing in four databases. One of the services the controller offered was to carry out e-mail marketing campaigns on behalf of companies. To do this, the controller used data collected by data brokers through entry forms for game contests or online product tests. These forms were misleading because the buttons to accept the use of data subjects’ data was much more prominent than those to reject it (this is also known as dark patterns). The controller relied on prior consent given for the initial collectors, and did not allow the data subject to withdraw consent as easily as they had given it. The DPA carried out an on-the-spot investigation of the company in 2022. On June 2024, the DPA rapporteur informed the controller of its breaches of Articles 5(1)(e), 6(1)(a) and 32 GDPR. The controller responded with two arguments- first, it could not foresee that the DPA’s conclusions, as there were no specific recommendations on direct marketing at the time of the inspection. The controller also argued that it had no role in obtaining consent when the data was first collected, and that the contractual and verification measures for the data collected were sufficient. The DPA considered that CALOGA acted as a joint controller for the purposes of transmitting the data to partners (these partners were considered joint controllers). The DPA first dismissed the controller’s foreseeability argument, stating there were rules applicable to direct marketing and consent for several years, and the recommendations on consent through cookies can serve as a guideline for general collection of consent. The DPA also considered the contractual and verifications measures taken by the controller as insufficient. According to Article 7 GDPR, the controller must prove that the data subject has consented to the data processing concerning th