DPA case SAN-2021-022 – €120,000 Fine (France, 2021)

A company selling furniture with its main establishment in France undertook an investigation by the French DPA. The investigation was performed both online and on-site. It revealed that the company had no data retention procedures in place, and that personal data was not regularly deleted or archived. The investigation also revealed that the company did not provide its customers with information about the legal basis for processing, nor about the data retention period. Lastly, the investigation revealed that customer accounts belonging to data subjects who had requested data erasure, had in fact not been deleted but instead simply deactivated. The French DPA, acting as lead supervisory authority, sent a draft order to the other supervisory authorities involved. The Berlin supervisory authority objected in accordance with article 60(4) GDPR and requested that the draft order be turned into a draft penalty, and more specifically an administrative fine. The furniture company contested this objection, arguing that the company had very few sales in Germany. The French DPA first held that the Berlin DPA's objections to the draft decision had been reasonable, and that the number of sales in Germany was irrelevant under Chapter VII GDPR. The French DPA amended its original draft to a draft penalty. The French DPA subsequently held that the lack of an implemented data retention procedure constituted a breach of article 5(1) GDPR. The lack of information about the legal basis date retention procedures provided in the online store constituted a breach of article 13 GDPR. The DPA noted that the link between these two breaches did not prevent them from being sanctioned as separate breaches. The DPA furthermore held that the obligation to comply with requests for erasure under article 17 GDPR had been breached. The DPA imposed an administrative fine of EUR 120,000.