- Enforcing jurisdiction
- France · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Company – €3,500,000 Fine (France, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A company in France was fined €3.5 million for mishandling customer data in a loyalty program. The data protection authority found that the company transferred customer data to a third party without a valid legal reason and failed to inform users. This case highlights the importance of transparency and legal compliance in data handling.
What happened
The authority imposed a fine for transferring customer data to a third party without sufficient legal basis.
Who was affected
Customers participating in the loyalty program whose data was improperly shared.
What the authority found
The authority ruled that the company violated GDPR by not having a valid legal basis for data transfers and failing to conduct a required data protection impact assessment.
Why this matters
This ruling underscores the need for companies to ensure they have proper legal grounds for data processing and to keep customers informed. Businesses should evaluate their data handling practices to comply with GDPR.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 5 March 2026.
Processing notes: date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The French DPA has imposed a fine of EUR 3,500,000 on a company. The controller operated a loyalty program in France and 16 other EU countries, using customer data obtained through the program to transfer it to a third party for marketing purposes. The controller had no sufficient legal basis for this transfer and also failed to inform the data subjects. Furthermore, the controller used an inadequate method to store passwords. Finally, the controller failed to conduct a data protection impact assessment, which would have been mandatory given the amount of data being processed and the cross-referencing of data.
Related Enforcement Actions (0)
No other enforcement actions found for Company in FR
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
30 December 2025
Authority
Commission Nationale de l'Informatique et des Libertés
Fine Amount
€3,500,000
Enforcement Tracker ID
ETid-2998
GDPRhub ID
gdprhub-9769About this data
Cite as: Cookie Fines. Company - France (2025). Retrieved from cookiefines.eu
Last updated: