GROUPE CANAL + – €600,000 Fine (France, 2023)

The French DPA has imposed a fine of EUR 600,000 on GROUPE CANAL+ for multiple violations of the GDPR. The DPA determined that the data controller failed to demonstrate that it had obtained valid prior consent from individuals for sending electronic promotional messages. Additionally, the DPA found that the data controller did not provide adequate information regarding the retention periods of personal data in its privacy statement. Furthermore, the DPA observed that the data controller's processors did not furnish sufficient information to potential customers during marketing calls. Moreover, the DPA found that the data controller did not adequately respond to requests from data subjects in certain cases. In addition, the data controller failed to establish contractual regulations for the processing of personal data by its processors. Finally, the DPA noted that the controller had not properly secured passwords for the company's employees and failed to report a data breach. In determining the amount of the fine, the DPA considered the violations identified, as well as the company's cooperation and corrective actions taken during the proceedings to ensure compliance.