GDPR: IT’S TIME TO COMPLY!

Complaints, checks, sanctions:
THE 2019 ACTIVITY REPORT OF THE CNIL IS PUBLISHED

(SOURCE: https://www.cnil.fr/fr/mediatheque/rapports-annuels)

In addition to very interesting articles, notably on the difference between GDPR and the ePrivacy directive, or even on facial recognition, the CNIL publishes figures relating to complaints, controls and sanctions imposed. The opportunity for LEGALPROTECH AVOCATS to emphasize the need for any public or private organization to comply with the General Data Protection Regulation (GDPR).

Complaints constantly increasing

Reading the report, we discover that complaints have increased by 27% compared to 2018. 43% of checks carried out in 2019 were based on a complaint. Corrective measures, such as a call to order, formal notice, financial sanction, injunction could also be adopted as a follow-up to these complaints.

In the professional field we can cite among the complaints monitoring employees at their place or during their working time, through tools such as video surveillance, geolocation, telephone tapping, which accounted for numerous complaints (10.7% of complaints received in 2019), whether in the private or public sector.

The number of complaints relating to the receipt of prospecting is also particularly important (14.7% of complaints).

Finally, data security defects are now a recurring reason for complaints to the CNIL: data accessible on the internet or communicated to third parties, passwords transmitted in plain text or not sufficiently complex, etc.

Controls carried out by the CNIL and IT services

In 2019, 7,000 investigative acts were carried out by the CNIL services in 2019. As indicated above, 43% were from complaints or reports, 31% were carried out at the initiative of the CNIL, particularly in view of current events, 21% resulted from priority themes decided by the CNIL and 5% were carried out in the extension of formal notices or sanction procedures.

It is interesting to note that in 2019, the control services paid particular attention to the conditions under which a service provider processes personal data, on behalf of a data controller. Checks were therefore carried out on this topic with 15 organizations, service providers and IT solutions.

It emerged that certain actors wrongly thought they were not subject to the GDPR, considering that only providing a maintenance service, their access to personal data was only occasional. However, access is in itself processing and therefore the company is subject to the provisions of the GDPR.

Financial sanctions imposed

Much noise has been made about the record sanction taken against GOOGLE.

Indeed, following complaints filed by the associations La Quadrature du Net and None of your business in May 2018, on January 21, 2019, the CNIL imposed a fine of 50 million euros against Google for lack of transparency, unsatisfactory information and lack of valid consent for the personalization of advertising.

In total, in 2019, the restricted panel imposed 8 sanctions (including the aforementioned sanction), including 5 public, as well as 2 deliberations leading to a dismissal of the case. These sanctions consist of 7 administrative fines totaling 51,370,000 euros and 5 injunctions under penalty ranging from 200 euros to 3,000 euros per day of delay. The same deliberation may pronounce several corrective measures.

Other financial sanctions include:

• Property management company – Lack of security of personal data and non-compliance with retention periods – Financial penalty of 400,000 euros
• Document translation company – Inadequate and excessive data, irrelevance, unsatisfactory information, lack of security of personal data, Video surveillance – Financial penalty of 20,000 euros and injunction under penalty
• Insurance intermediary company – Lack of security of personal data – Financial penalty of 180,000 euros
• Insulation equipment installation company – Non-adequacy, non-relevance and excessive nature of data, failure to inform individuals, non-compliance with the right of opposition, non-cooperation with the supervisory authority, unsupervised transfer of data outside the EU – Financial penalty of 500,000 euros and injunction under penalty.

Bring your structure into GDPR compliance

Although financial sanctions remain limited in volume to date, this should not encourage public or private organizations to exempt themselves from their obligations. For the record, the CNIL can also issue formal notice, calls to order, warnings likely to be made public and the long-term financial impact of which may be just as significant.

LEGALPROTECH AVOCATS and Maître Christelle REYNO, CNIL/AFNOR certified DPO, support you in your compliance. Contact us @ contact@legalprotech.fr, or on 05 90 44 67 67, to make an appointment for a free initial pre-diagnosis.