DPA case Referral Number: 20019819 – Violation Found (France, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
France's data protection authority found that a company failed to inform a customer about how their email would be used for product recalls. The authority noted that the privacy policy did not mention this processing. This case highlights the importance of transparency in how companies handle personal data.
What happened
A company did not disclose in its privacy policy that it would process personal data for product recalls.
Who was affected
The customer who inquired about the use of their email address.
What the authority found
The authority ruled that the company breached transparency requirements under GDPR.
Why this matters
This finding emphasizes the need for companies to clearly communicate how they use personal data, fostering trust with their customers.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller asked data subject to provide an email address so that contact could be made in the event of a product recall. The data subject asked for confirmation and guarantee about how their personal data would be used. The controller referred the data subject to the privacy policy on their website. The existence of processing personal data relating to a product recall was omitted from the privacy policy. As the Privacy Policy on the website did not mention the existing of processing of personal data relating to product recall, this constitutes a breach of Article 12 GDPR and Article 13 GDPR.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Referral Number: 20019819 in FR
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
6 December 2021
Authority
Commission Nationale de l'Informatique et des Libertés
GDPRhub ID
gdprhub-5106About this data
Cite as: Cookie Fines. DPA case Referral Number: 20019819 - France (2021). Retrieved from cookiefines.eu
Last updated: