CNP Assurances – Court Ruling (France, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The French Council of State ruled that the CNIL did not err by asking CNP Assurances for explanations about a health control issue before taking further action. This case shows that preliminary inquiries are part of the process before any formal decisions are made.
What happened
The French Council of State upheld that CNIL's request for explanations from CNP Assurances was a valid preparatory step in a data protection investigation.
Who was affected
A complainant who challenged the actions of CNP Assurances regarding the interruption of loan reimbursement following a health control.
What the authority found
The CE concluded that CNIL's request for explanations was a necessary preparatory act and not a mistake in the process of deciding on further measures.
Why this matters
This ruling clarifies that regulatory bodies can request information as part of their investigative process without immediately issuing sanctions. Companies should be prepared to provide detailed explanations when questioned by data protection authorities.
GDPR Articles Cited
National Law Articles
A data subject (the Complainant) filed a complaint with the French DPA (CNIL) against the decision of an insurance company (CNP Assurances) to interrupt the reimbursement of his loan following a health control, on the ground that such control would not be compliant with the GDPR. As a first measure, the CNIL requested CNP Assurances to provide explanations with respect to the health control. The Complainant considered that the CNIL did not take sufficient measures against the infringements. The CE considered that the fact that the CNIL initially asked CNP Assurances to explain itself does not preclude the CNIL from adopting additional measures once a final decision is taken in the light of the response from CNP Assurances. In particular, the CE considered that asking the controller for explanations was merely a preparatory act in view of adopting an administrative decision. Therefore, the CE concluded that the CNIL had not committed any mistake by not yet issuing a formal notice or a sanction against CNP Assurances.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for CNP Assurances in FR
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. CNP Assurances - France (2021). Retrieved from cookiefines.eu
Last updated: