The sanctions issued by the CNIL

Failure to respect the exercise of individuals' rightsdata security deficiency

€250,000 financial penalty and injunction under penalty payment

Lawfulness of the treatment
Lack of impact assessment
Lack of information to individuals

Call to order and injunction

Lack of data securityillegality of
processed data

Retention periods
Failure to
inform individuals
Failure to comply with requests for deletion of data
Failure to keep data secure
Consent for commercial prospecting

Duration of retention lack of
Information to individuals 

Financial penalty of €1,750,000

Failure to inform individuals - obligation to
Regulate relations with a subcontractor

Financial penalty of €50,000

Failure to comply with requests to rectify data
Failure to comply with erasure requests
lack of a register of processing activities
Cooperation with the CNIL

Lawfulness of the processing - retention period -
accuracy of the data
Lack of data security

Failure to inform individuals

Failure to comply with the principles of data minimization and responsibility for data retention
Lack of data security

Financial penalty of  €400,000

Obligation to regulate relationships with subcontractors
Failure to maintain data security
Obligation to notify individuals of a data breach

Failure to respect the right of access
Failure to respect the right of rectification
Failure to respect the right to object
Obligation to protect data by design
Failure to ensure data security

Retention period
Failure to inform individuals
Failure to comply with deletion requests
Obligation to regulate relations with subcontractors
Failure to ensure data security

Cookie refusal mechanism
Failure to inform individuals