Table of Contents
Protection of personal data: CNIL sanction
The recent implementation of the General Data Protection Regulation (GDPR) has brought to light the numerous sanctions imposed on companies that violate individuals’ privacy.
A European phenomenon, the UK’s Data Protection Authority (DPA) recently fined Gloucestershire Police £80,000 for sending an email to 56 recipients without using the “BCC” (blind carbon copy) function.
This led to the disclosure of the names of victims, witnesses, lawyers, and journalists, as well as the fine levied against the telecommunications company BT, which was set at £77,000 for sending over five million spam emails promoting charities.
Find more DPA decisions related to personal data protection violations.
GDPR and company breaches: Optical Center sanctioned
In France, and following the CNIL’s sanctions decisions since the beginning of the year, Optical Center was fined €250,000 on May 7th for failing to adequately secure the data of its customers placing online orders through its website.
Informed of a data breach in July 2017, a CNIL audit revealed easy access to several hundred of the company’s customer invoices, which could include health data such as prescription information and social security numbers.
Upon being notified of the clear breaches of the GDPR, Optical Center contacted its service provider to resolve the IT vulnerability as quickly as possible.
Personal data: Optical Center sanctions and remedies
In 2015, Optical Center was already fined €50,000 by the CNIL (French Data Protection Authority) for various breaches of customer data security, a decision upheld on appeal by the Council of State.
The issues at hand included the lack of encryption for data transmitted on the platform – using the HTTP protocol instead of HTTPS – and the absence in a contract of a clause specifying the obligations of a subcontractor regarding the protection of customer data security and confidentiality.
The CNIL’s failure to respond to the formal notice, as well as the company’s “lack of cooperation and resistance during the investigation,” were key factors in the initial ruling.
Contesting this new penalty, Optical Center has indicated its intention to appeal again to the Council of State, arguing that “no customer suffered any harm and Optical Center committed no error.”
Find our presentation of the appeal procedures against CNIL sanctions.
CNIL : confirmation of the sanction and reduction of the sentence
Updated 2019. In a decision dated April 17, 2019, the French Council of State upheld the principle of the sanction imposed by the CNIL (French Data Protection Authority) against Optical Center for failing to meet its data security obligations. It reduced the fine by €50,000, from €250,000 to €200,000.
To justify this reduction, the Council of State highlighted the CNIL’s lack of responsiveness to Optical Center’s failure to correct the identified breaches as soon as they were notified. It concluded that the CNIL had imposed a disproportionate sanction.
“When the CNIL identifies breaches of the obligation to ensure data security and confidentiality, it is incumbent upon it, in imposing a sanction subject to judicial review, to consider the nature, seriousness, and duration of these breaches, as well as the data controller’s conduct following this finding.”
By imposing a fine of €250,000 without taking into account the speed with which Optical Center implemented corrective measures to address the identified deficiencies, the CNIL’s restricted panel imposed a disproportionate penalty on the company.
A fair assessment of the specific circumstances will be made by reducing this fine to €200,000.
The grounds for this decision do not require the CNIL to undertake any further action. Moreover, the CNIL’s finding that the website in question has been brought into compliance is published on the Légifrance website and on the CNIL’s website, along with the contested decision.
However, this decision, which amends the fine imposed on Optical Center, requires the CNIL to publish it in the same manner.
