Société nouvelle de l’annuaire français (SNAF) – €3,000 Fine (France, 2021)

The CNIL received 16 complaints between 2018 and 2019 specifying that users were facing difficulties for deleting or rectifying their data on the annuairefrancais.fr website. The website hosts information about companies registered in France that are published on the SIRENE database - a public database managed by the National Institute for Statistics and Economic Studies (INSEE). The website annuairefrancais.fr offers the possibility of creating an account allowing users to get information about registered companies and to subscribe to commercial offers from these companies. After an initial inspection, the CNIL found that the processing was not compliant with the GDPR and issued a formal notice giving the company two months to bring its processing practices into compliance by implementing a clear policy regarding data deletion and rectification, establishing a record of processing activities and dealing with the data subjects' requests. Noting that the company had not actively cooperated and had failed to implement the required measures within the prescribed period, as spelled out in the formal notice, the CNIL imposed a fine of €3,000 on the company Société nouvelle de l'annuaire français. More specifically: * concerning Article 16 GDPR (right to rectification), it was found that the company had failed to follow up on a data subject's request to rectify his postal address from his personal to his professional address within the prescribed period. The deadline for rectifying the personal data of the complainant had been largely exceeded as the company's director implemented the required measures in July 2021, whereas the deadline expired in September 2020; * concerning Article 17 GDPR (right to erasure), it was also found that the erasure requests of several data subjects had not been processed within the prescribed period. Several requests which were supposed to have been processed had, in fact, not been followed up on, even after the formal notice period had expired. The CNIL considered that if the data controller had indeed reinitialized its database by taking only the INSEE data, this was not sufficient to ensure that the requests were taken into account; * concerning Article 30 GDPR (record of processing activities), it was found that the company had failed to create and complete a record of processing activities although processing a large amount of personal data constituted the core of its activity.