- Enforcing jurisdiction
- France · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
SERGIC (Real Estate) – €400,000 Fine (France, 2019)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
SERGIC, a real estate company in France, was fined €400,000 for failing to protect sensitive user documents online. This case serves as a warning for businesses to implement strong security measures to protect personal information.
What happened
SERGIC allowed sensitive documents of rental candidates to be accessed online without proper security.
Who was affected
Rental candidates whose sensitive documents were exposed online.
What the authority found
The authority found SERGIC violated data protection rules by not securing sensitive personal data and storing it longer than necessary.
Why this matters
This case shows that companies must prioritize data security and limit data retention to avoid hefty fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The CNIL based the penalty on two grounds: Lack of basic security measures and excessive data storage. As to the first, sensitive user documents uploaded by rental candidates (including ID cards, health cards, tax notices, certificates issued by the family allowance fund, divorce judgments, account statements) were accessible online without any authentication procedure in place. Although the vulnerability was known to the company since March 2018, it was not finally resolved until September 2018. In addition, the company stored the documentation provided by candidates for longer than necessary. The CNIL took into account i.a. the seriousness of the breach (lack of due care in addressing vulnerability and the fact that the documents revealed very intimate aspects of users' lives), the size of the company and its financial standing.
Related Enforcement Actions (0)
No other enforcement actions found for SERGIC (Real Estate) in FR
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
28 May 2019
Authority
Commission Nationale de l'Informatique et des Libertés
Fine Amount
€400,000
About this data
Cite as: Cookie Fines. SERGIC (Real Estate) - France (2019). Retrieved from cookiefines.eu
Last updated: