RATP – €400,000 Fine (France, 2021)

The CNIL received a complaint from several unions in May 2020 regarding the collection and storage of data on the number of days that RATP's agents had been on strike days. These data were kept in files normally used for careers advancement procedures. The RATP recognized that four bus transport units were concerned by this practice. The investigation conducted by the CNIL confirmed that this practice had been commonplace in at least three bus transport units of the RATP. During the investigation, the CNIL also found other breaches regarding storage limitation and data security. The CNIL held that it was unlawful to process information on the number of days an agent had been on strike in the context of career advancement procedures because such information was unnecessary for the purpose of the processing. In particular, the RATP should have limited such information to the number of days of absence of each agent, regardless of the reason behind such absence(s). As a consequence, the CNL found that the RATP had been processing these data in breach of the principle of data minimization (Article 5(1)(c) GDPR). The investigation also revealed other breaches with respect to the principle of storage limitation (Article 5(1)(e) GDPR). Indeed, the app used to monitor the work of RATP's agents was storing personal data for an excessive period of time. Moreover, agents' files were kept for more than three years after the commission on careers advancement had taken a decision. In the opinion of the CNIL, the RATP should have kept such files for 18 months maximum. Finally, the investigation also revealed severe security flaws. In particular, it was found that authorized agents could access an excessive amount of data (including human resources files) regardless of their role, from all bus transport units, and could also extract all the data from the app, without any restriction. Because of this, the CNIL considered that the RATP had violated Article 32 GDPR. Taking into acco