- Enforcing jurisdiction
- France · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
CNP Assurances – Court Ruling (France, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
CNP Assurances faced a complaint for stopping a loan reimbursement after a health check. The French DPA asked the company for explanations but did not take further action. This case highlights the importance of proper procedures when handling personal health data.
What happened
CNP Assurances interrupted a loan reimbursement based on a health control.
Who was affected
The person who filed the complaint regarding their loan reimbursement.
What the authority found
The court found that the DPA's request for explanations was a preliminary step and did not require immediate sanctions against CNP Assurances.
Why this matters
This ruling shows that companies may not face immediate penalties for initial inquiries, but they should be prepared for further scrutiny. It emphasizes the need for clear communication and compliance in handling sensitive health information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject (the Complainant) filed a complaint with the French DPA (CNIL) against the decision of an insurance company (CNP Assurances) to interrupt the reimbursement of his loan following a health control, on the ground that such control would not be compliant with the GDPR. As a first measure, the CNIL requested CNP Assurances to provide explanations with respect to the health control. The Complainant considered that the CNIL did not take sufficient measures against the infringements. The CE considered that the fact that the CNIL initially asked CNP Assurances to explain itself does not preclude the CNIL from adopting additional measures once a final decision is taken in the light of the response from CNP Assurances. In particular, the CE considered that asking the controller for explanations was merely a preparatory act in view of adopting an administrative decision. Therefore, the CE concluded that the CNIL had not committed any mistake by not yet issuing a formal notice or a sanction against CNP Assurances.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for CNP Assurances in FR
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
30 September 2021
Authority
DPA CE
About this data
Cite as: Cookie Fines. CNP Assurances - France (2021). Retrieved from cookiefines.eu
Last updated: