DPA case SAN-2024-003 – €310,000 Fine (France, 2024)

On 23 September 2021, the French DPA (“CNIL”) carried out an inspection on Foriou’s premises (“controller”), in particular regarding the legal basis of the processing and the security measures taken. The controller was in the business of marketing and managing loyalty programs and cards. In order to promote its programs, until 2021, the controller carried out telephone canvassing campaigns using prospect files purchased with several data suppliers who collected the data via entry forms for online competitions. The personal data collected was the following: surname, first name, title, email address, date of birth and postal address. During its investigations, the CNIL discovered that the data suppliers all had similar forms on their websites: there were fields which enabled the data subject to enter their contact details. Underneath these fields were a “Validate”, “I validate” or “I answer questions to apply” button. Above or below this button, a text specified that by clicking on it, the user declared that they read the data supplier’s data protection policy and accepts that the data collected would be used to send them offers from the company’s partners. Hyperlinks were provided to access the data protection policy as well as the list of partners concerned. However, the list did not mention the controller. At the end of the text it was specified that if the user wished to continue without receiving offers from the data supplier’s partners, they could click a link in the text (“click here”). Therefore, data subjects could either click on the “Validate” button and accept that their data would be used to send them offers from the data supplier’s partners or on the “click here” link to continue without receiving these offers. The controller also submitted 2 other forms in its observations. These forms contained “Validate my coordinates” and “Continue” buttons to validate participation in the game and transmit data to partners. The “click here” button remained unchange