PERFORMECLIC – €7,300 Fine (France, 2020)

The PERFORMECLIC Company's activity is the sending of commercial e-mails on behalf of advertisers. As such, the company holds a database of 20 million e-mail addresses that it has purchased from a third party company. Following the report made by the SIGNAL SPAM association, the French DPA carried out an on-site inspection at the company's premises on 18 September 2019. *Insofar as the operational activities of the company were implemented from Morocco, is the GDPR applicable and is the CNIL competent in this case? *How is the notion of "consent" to be understood in the context of email prospecting operations? *Is the processing of the telephone number in the context of prospection operations carried out solely by e-mail contrary to the principle of data minimisation provided for in [https://gdprhub.eu/index.php?title=Article_5_GDPR Article 5(1)(e) GDPR]? *Is the simple opening of a prospecting e-mail sufficient to characterise the prospect's interest in the products and services of the sender of the message, and thus to extend the retention period of this data? *Is the apposition of a standard mention at the bottom of a prospecting e-mail sufficient regarding the information standards provided for in [https://gdprhub.eu/index.php?title=Article_14_GDPR Article 14 GDPR]? The CNIL orders PERFORMECLIC to pay an administrative fine of €7300. It also issued an injunction to bring the processing into compliance with the provisions of the French Post and Electronic Communications Code and the GDPR, accompanied by a penalty payment of 1,000 euros per day of delay at the end of a two-month period following notification of the decision. Finally, the French DPA has made its decision public. The CNIL based its decision on the following grievances : = At the time of the audit, the manager of the company indicated to the CNIL that the operational activities of the company were carried out from Morocco and that, in the near future, he intended to end the company's