French Data Protection Authority (CNIL) · 30 December 2025
Company
Non-compliance with general data processing principles
Fine€3,500,000Fine issued
- Regulator
- French Data Protection Authority (CNIL)
- Decided
- 30 December 2025
- Country
- France
- Sector
- Industry and Commerce
- Regulator’s reference
- Not recorded
- Fino case number
- 2025/FR/001
What happened
The DPA fined a company €3,500,000 for failing to obtain valid consent from its loyalty program members for the purpose of transmitting their data to another company for direct marketing. Further, the DPA found violations of information and data security requirements.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 6Lawfulness of processing6(1)(a)Read →
- Art. 13Information to be provided where personal data are collected from the data subjectRead →
- Art. 32Security of processingRead →
- Art. 35Data protection impact assessmentRead →
- DPIA
- Data principles
- Data security
- Transparency
- Unlawful processing
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2025/FR/001.