Deliberation of the Restricted Committee No SAN-2024-004 of 4 April 2024
concerning
The Commission nationale de l’informatique et des libertés (French Data Protection Authority),
meeting in its Restricted Committee composed of
members;
Having regard to the end of the term of office of Mr Alexandre LINDEN on 1st February 2024;
Having regard to deliberation no. 2024-015 of 7 March 2024 electing Mr Philippe-Pierre
CABOURDIN as Chairman of the Restricted Committee of the Commission nationale de l'in-
formatique et des libertés;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 on the protection of personal data and on the free movement of such data;
Having regard to the French Postal and Electronic Communications Code;
Having regard to the French Data Protection Act no. 78-17 of 6 January 1978, and in particular
Articles 20 et seq.;
Having regard to Decree No 2019-536 of 29 May 2019 implementing Law No 78-17 of 6 January
1978 on data processing, data files and individual liberties;
Having regard to deliberation no. 2013-175 of 4 July 2013 adopting the internal regulations of the
CNIL (French Data Protection Authority);
Having regard to decision No 2021-191C of 29 June 2021 of the President of the CNIL (French
Data Protection Authority) to instruct the Secretary General to carry out or have carried out a
verification mission of the processing operations implemented by the by its
subsidiaries or on its behalf, in any place likely to be concerned by their implementation;
Having regard to the decision of the President of the CNIL (French Data Protection Authority)
appointing a rapporteur before the Restricted Committee, dated 4 April 2022;
Having regard to the report of Ms Valérie Peugeot, Commissioner-Rapporteur, notified to
on 23 August 2023;
Having regard to the written observations submitted by on 29 September 2023;
Having regard to the Rapporteur's reply to these observations, notified to the company on 20
October 2023;
Having regard to the closure of the investigation, notified to the company on 22 November 2023;
Having regard to the oral observations made at the meeting of the Restricted Committee on 7
December 2023;
1
Having regard to the preliminary deliberation of the Restricted Committee No SAN-2023-019 of
14 December 2023;
Having regard to the written observations submitted by the Rapporteur on 21 December 2023;
Having regard to the written observations submitted by the company on 28 December 2023;
Having regard to the oral observations made at the meeting of the Restricted Committee on 18
January 2024;
Having regard to the memo to the restricted committee submitted by the company on 29 January
2024;
Having regard to the other documents in the case file;
The following were present at the Restricted Committee meeting:
- Valérie Peugeot, Commissioner, heard in her report;
As representatives of
-
- ;
having spoken last;
The Restricted Committee adopted the following decision:
I. Facts and proceedings
1. (hereinafter referred to as "the Company"), whose registered office is situated
at is a subsidiary of the It manages
the " stores, which specialise in the retail sale of telecommunications
equipment. At 31 May 2023, the company had employees and stores, spread across
and Its revenue for 2021 was around million, with net income of
million.
2. To promote the catalogue of products sold in stores, the company carries out canvassing campaigns
by telephone and SMS using prospect files purchased from two main partners, and
It said it had sent around 1.4 million text messages between September 2020
and September 2021, and more than 220,000 between May 2022 and May 2023. With regard to
telephone prospecting, the company said it made around 3.2 million calls between May 2022 and
May 2023, to around 1.3 million prospective customers.
3. On 23 September 2021, a delegation of the Commission nationale de l’informatique et des libertés
(hereinafter “the CNIL” or “the Commission”) carried out an inspection on the company’s
premises, in order to verify compliance with the provisions of law No 78-17 of 6 January 1978 as
amended on information technology, files and freedoms (hereinafter “the French Data Protection
2
Act” or “law of 6 January 1978 as amended”) and Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to
the processing of personal data and on the free movement of such data (hereinafter the
“Regulation” or “GDPR”).
4. Official report No 2021-191/1, drawn up on the day of the inspection, was sent to the company on
30 September 2021.
5. The company provided additional documents on 5 October and 22 November 2021.
6. On 4 April 2022, the President of the Commission appointed Ms Valérie Peugeot as Rapporteur
on the basis of Article 22 of the amended Act of 6 January 1978.
7. In accordance with Article 56 GDPR, on 9 June 2023, the CNIL informed all the European
supervisory authorities of its competence to act as lead supervisory authority for cross-border
processing carried out by the company, as a result of the fact that the company's principal place of
business was in France. Following exchanges between the CNIL and the European data protection
authorities as part of the one-stop shop mechanism, Italy, Spain, Portugal and Belgium declared
themselves concerned.
8. On 8 June and 13 July 2023, the Rapporteur sent two additional requests to which the company
replied on 23 June and 3 August 2023.
9. On 23 August 2023, at the end of her investigation, the Rapporteur sent the company a report
detailing the breaches of Articles 6, 14 and 32 GDPR and Article L34-5 of the French Postal and
Electronic Communications Code (hereinafter "the CPCE") which it considered constituted in the
case in point. This report proposed that the Restricted Committee impose an administrative fine
on the company. It also proposed that the decision be made public.
10. On 29 September 2023, the company submitted observations in response to the sanction report.
11. On 20 October 2023, the rapporteur responded to the company’s observations.
12. On 22 November 2023, the Rapporteur informed the company and the Chairman of the Restricted
Committee that the investigation was closed, pursuant to Article 40 III of Decree No 2019-536 of
29 May 2019 implementing the Data Protection Act.
13. On the same day, the company was informed that the matter had been placed on the agenda of the
Restricted Committee meeting of 7 December 2023.
14. The Restricted Committee held a meeting on 7 December 2023.
15. By preliminary decision No SAN-2023-019 of 14 December 2023, sent by email to the company
on the same day and notified by post on 21 December 2023, the Restricted Committee asked
and the Rapporteur to produce an additional document, which the company
raised at the meeting of 7 December 2023.
16. On 21 December 2023, the Rapporteur provided the Restricted Committee with an exhibit entitled
3
17. On 28 December 2023, the company communicated to the Restricted Committee an exhibit also
entitled
18. Pursuant to Article 41 of Decree No 2019-536 of 29 May 2019, was on 18
January 2024 notified of a meeting of the Restricted Committee on 21 December 2023;
19. The Rapporteur and the company made verbal observations at the Restricted Committee session.
II. Reasons for the decision
A. On the appointment of the Rapporteur
20. Pursuant to Article 39 of Decree No. 2019-536 of 29 May 2019, “when a measure provided for in
Article 20(III) of the Law of 6 January 1978 […] is likely to be pronounced, the chairman of the
authority shall appoint a rapporteur who does not belong to the restricted committee, and shall
inform the controller or processor in question”.
21. The Restricted Committee notes that, pursuant to these provisions, by decision of 7 April 2022,
the President of the CNIL appointed Ms Valérie Peugeot, Commissioner, to draw up the report
enabling the Restricted Committee to adopt its decision in the context of file "CTX n°2022-019
22. At the meeting of 7 December 2023, and then in its observations of 28 December 2023,
argued that the appointment was null and void, insofar as it had been made on
the basis of a referral that did not concern
23. The Restricted Committee noted that on 1 July 2020, the CNIL had received a complaint No
against several companies in the
24. By decision No 2021-191 of 29 June 2021, the President of the CNIL instructed the Secretary
General to carry out, or have carried out, a verification mission of the processing operations carried
out by the or its subsidiaries.
25. The inspection report dated 23 September 2021 stated that "the purpose of the inspection is to
carry out an on-site verification of the compliance of personal data processing operations
implemented by the or its subsidiaries, in particular and [...]". It
stated that "in particular, this involved carrying out verifications after the closure on 4 May 2021
of formal notices MED No 2020-041 dated 24 November 2020 against and MED No 2020-
042 dated 24 November 2020 against it also involved following up on referral No
relating to the exercise of a complainant's right of access".
26. The Restricted Committee took the view that, insofar as referral No had given rise to
verifications carried out during the on-site inspection on 23 September 2021, which targeted the
and all its subsidiaries, including the fact that this referral was
mentioned in the President's decision to appoint Ms Valérie Peugeot as Rapporteur had no bearing
4
on the validity of this appointment, even though said referral had not specifically been aimed at
B. With regard to the European cooperation procedure
27. Under Article 4(23)(b) GDPR, "cross-border processing" means "processing of personal data
which takes place in the context of the activities of a single establishment of a controller or
processor in the Union but which substantially affects or is likely to substantially affect data
subjects in more than one Member State".
28. The Rapporteur noted that the company had stores
. She noted that, although the company had indicated that its commercial
canvassing operations had been conducted exclusively from France, targeting French nationals, it
had nevertheless transmitted recordings of canvassing calls to Belgian nationals, with the aim of
promoting its stores located in Belgium. In addition, the Rapporteur noted that the company had
also indicated that its customer database contained all the customer data for
stores in Europe. She took the view that the company was therefore processing cross-border
personal data.
29. In its defence, with regard to commercial canvassing by telephone, the company stated that it only
canvassed individuals domiciled in France, in order to generate traffic in its points of sale located
in France. With regard to the recordings of calls to Belgian nationals sent to the delegation, it stated
that " Belgium, the head entity carrying out activities in
Belgium, does not have staff dedicated to running a customer service department. Also, for
telephone or SMS canvassing operations carried out with a view to generating traffic in points of
sale located on Belgian territory, Belgium was able to subcontract this
canvassing activity to by using the services of this company's sales platforms in France. As
a result, the teams responsible for canvassing were given access to a Belgian canvassing file
acquired from Belgium".
30. Firstly, with regard to the commercial canvassing by telephone covered by the breach of Article
6 GDPR, the Restricted Committee noted that the breach had been based on the design of forms
implemented by data brokers who only provided with the data of French
nationals. In these circumstances, despite the fact that the company had canvassed Belgian
nationals by telephone, the Restricted Committee took the view that the processing concerned by
the breach of Article 6 GDPR did not constitute cross-border processing.
31. Secondly, with regard to the recordings of telephone canvassing calls covered by the breach of
Article 14 GDPR, the Restricted Committee noted that these targeted French nationals as well as
Belgian nationals, in order to promote stores located in Belgium. Thus, the cross-border nature of
the processing was clear.
32. Thirdly and finally, the company stated that its customer database, which was the subject of the
breach of Article 32 GDPR, had contained customer data from all points of
5
sale in Europe. The Restricted Committee therefore took the view that the management of this
database constituted cross-border processing within the meaning of Article 4(23) GDPR.
33. Pursuant to Article 60(3) GDPR, the draft decision adopted by the Restricted Committee was
forwarded to the other competent European supervisory authorities, with a view to enabling them
to make relevant and reasoned objections to the processing operations and breaches which concern
them, on 20 February 2024. The Restricted Committee noted that the following supervisory
authorities were concerned by this procedure: Belgium, Italy, Spain, Portugal.
34. As of 20 March 2024, none of the supervisory authorities concerned had raised a relevant, reasoned
objection to this draft decision, so that, pursuant to Article 60(6) of the GDPR, they are deemed to
have approved it.
C. On the breach of the obligation to obtain the consent of the data subjects for the
implementation of commercial prospecting by electronic means
35. Under the terms of Article L34-5CPCE, "direct canvassing by means of an automated electronic
communications system […], a fax machine or electronic mail using the contact details of a natural
person […] who has not previously expressed his/her consent to receive direct canvassing by this
means is prohibited. For the purposes of this article, consent means any free, specific and
informed expression of will by which a person accepts that personal data concerning him/her may
be used for the purposes of direct marketing. […]”.
36. Under Article 4(11) GDPR, “consent” of the data subject means “any freely given, specific,
informed and unambiguous indication of the data subject's wishes by which he or she, by a
statement or by a clear affirmative action, signifies agreement to the processing of personal data
relating to him or her”.
37. Pursuant to the combined provisions of Articles L34-5 CPCE and 4(11) GDPR, the organisation
that carries out commercial canvassing by electronic means must have the unambiguous, specific,
free and informed consent of the data subjects.
38. The Rapporteur noted that the company had indicated that it carried out commercial canvassing
by SMS using prospect files purchased from data brokers. She noted that the delegation's findings
had established that these brokers were collecting data from data subjects via online competition
entry forms.
39. In proposing that the Restricted Committee take the view that the company had breached its
obligations under Article L34-5 CPCE, as clarified by the provisions of Article 4(11) GDPR, the
Rapporteur based her opinion on the fact that the design of these forms did not enable users to
express their consent in a clear and unambiguous positive act, and strongly encouraged them to
agree to the transmission of their data to the company's partners for canvassing purposes.
40. In defence, the company relied on the terms of the contract linking it to one of its suppliers,
taking the view that it could not be held responsible for the non-compliant actions of
its service provider. With regard to the other supplier, it stated that it had no
6
contractual relationship with it before November 2021 and that the majority of the files received
came from supplemented by contributions from which itself used a
network of subcontractors including
41. In the case in point, it was clear from the investigation that carried out
commercial canvassing by SMS using prospect files purchased from data suppliers, who were
responsible for obtaining the consent of the data subjects at the time the data was collected.
Between September 2020 and September 2021, prospecting SMS messages were sent.
The number of messages sent between May 2022 and May 2023 was .
42. Firstly, with regard to the Restricted Committee noted that during the
inspection on 23 September 2021, the company had indicated that "canvassing SMS messages
relating to the catalogue are sent to prospects supplied by
because is able to target prospects close to the stores". This involved extracting
5,000 prospect files supplied by The company also provided the delegation
with two purchase orders from dated 3 August 2021, for the sale of several
tens of thousands of files to
43. On the basis of these factors, the Restricted Committee took the view that had
indeed been using the prospect files supplied by on the date of the inspection.
44. Secondly, the Restricted Committee pointed out that when the data of prospective customers had
not been collected directly from them by the prospecting organisation, consent may have been
obtained at the time of the initial collection of the data by the initial collector, on behalf of the
organisation that was to carry out the subsequent prospecting operations. Otherwise, it is up to the
prospecting organisation to obtain such consent before carrying out any prospecting (CNIL, FR,
24 November 2022, Sanction, No SAN-2022-021, published).
45. As a result, in its capacity as controller, is obliged to check that the conditions
allowing it to carry out commercial prospecting operations have been met. In this respect, the
Restricted Committee held an organisation liable on the basis that a simple contractual undertaking
by its data broker to comply with GDPR and the rules applicable to commercial canvassing did
not constitute a sufficient measure (CNIL, FR, 24 November 2022, Sanction, No SAN-2022-021,
published).
46. Thus, with regard to the contractual commitments of which relies
on, the Restricted Committee took the view that the contractual obligations that may be imposed
on suppliers could not exonerate from its liability as controller, despite the
possible existence of liability on the part of suppliers.
47. Thirdly, the Restricted Committee pointed out that the specific consent required by the provisions
of Article L34-5 CPCE could only result from the express consent of the user, given in full
knowledge of the facts after adequate information on the use to be made of his/her personal data.
It is therefore important to ensure that the data subjects have given their unambiguous, specific,
free and informed consent when their personal data is collected via the forms used to take part in
competitions.
7
48. In this respect, the Restricted Committee noted that the work carried out on cookie practices with
regard to consent gathering banners could be used to assess more generally the conditions for
gathering free, unambiguous, specific and informed consent, and serve as a reference for
commercial prospecting when it was based on gathering consent.
49. Furthermore, on the same conditions of consent, the Court of Justice of the European Union
(hereinafter “CJEU”) specified, in its Planet49 GmbH decision: “Article 7(a) of Directive 95
provides that the consent of the data subject may make such processing lawful provided that such
consent is “’undoubtedly’ given by the data subject. However, only active behaviour on the part
of this person with a view to expressing his consent is likely to meet this requirement.” (CJEU,
Grand Chamber, 1 October 2019, Planet49 GmbH, C-673/17, ECLI:EU:C:2019:801, §54) If
consent was not unambiguously given, it had to be considered to be lacking, which rendered the
processing unlawful for lack of a legal basis. More specifically on the methods of collection, the
CJEU states that "the expression of will referred to in Article 2(h) of Directive 95/46 must, in
particular, be 'specific', in the sense that it must relate precisely to the data processing concerned
and cannot be inferred from an expression of will having a distinct purpose. In this case, contrary
to Planet49's argument, the fact that a user activates the button to take part in the promotional
game organised by that company cannot therefore be sufficient to consider that the user had
validly given his consent to the placement of cookies" (Idem, §§ 58-59).
50. In addition, the Conseil d'Etat held that "free, specific, informed and unambiguous consent can
only be express consent from the user, given in full knowledge of the facts and after adequate
information on the use to be made of his personal data." (CE, 10th and 9th joint chambers, 19 June
2020, Google LLC, No 430810, pt. 21).
51. The Restricted Committee also noted, by way of example, that the 5/2020 guidelines on consent,
adopted on 4 May 2020 by the Article 29 Working Party (now the European Data Protection
Committee, hereinafter "EDPB"), specified that the free nature of consent "implies real choice and
control for the data subjects". As a general rule, GDPR states that if the data subject is not
genuinely able to exercise a choice, feels compelled to consent or will suffer significant adverse
consequences if he or she does not consent, the consent is invalid […] In general terms, any
inappropriate pressure or influence exerted on the data subject (which may manifest itself in
various ways) preventing him or her from exercising his or her will will render the consent
invalid."
52. By way of illustration and comparison, in its Deliberation No 2020-092 of 17 September 2020
adopting a recommendation proposing practical arrangements for compliance in the event of
recourse to "cookies and other tracers", the Commission recommended that the organisations
concerned ensured "that users are fully aware of the options available to them, in particular through
the design chosen and the information provided (§ 10) […] In order not to mislead users, the
Commission recommended that controllers ensure that choice gathering interfaces do not
incorporate potentially misleading design practices that lead users to believe that their consent is
compulsory or that visually emphasise one choice rather than another. It is recommended that
buttons and fonts be of the same size, easy to read and highlighted in the same way." (§ 34).(§ 34)
8
It adds that “care should be taken to ensure that the information accompanying each actionable
element enabling consent or refusal to be expressed is easily understandable and does not require
efforts of concentration or interpretation on the part of the user. In particular, it is advisable to
ensure that it is not worded in such a way that a quick or inattentive reading could lead users to
believe that the option selected produces the opposite of what they thought they were choosing.”
(§ 23) Otherwise, the unambiguous nature of the consent would not be characterised.
53. The Restricted Committee also points out that studies carried out on the practices of digital
interfaces, in particular with regard to cookies, have shown that the appearance of banners
requesting consent has a considerable impact on user choice, as it may encourage users to make
choices that do not reflect their preferences on data sharing.
54. In the case in point, it is clear from the documents in the file that and
suppliers of prospect data to collect the data of the data
subjects (last name, first name, title, email address, mobile phone number, date of birth and postal
address) via entry forms for online competitions, in order to enable their partners to use them in
their commercial prospecting.
55. With regard to the findings made by the delegation during the inspection, the Restricted Committee
noted that the forms accessible from the websites
were similar. Beneath the fields enabling
the data subjects to enter their contact details (which were requested by the formulas "fill in your
contact details below in the event of winning" or "fill in your contact details below to apply") was
a "VALIDATE", "I VALIDATE" or "I ANSWER QUESTIONS TO APPLY" button. Above or
below this button, a text specified that by clicking on it, the user declared that he had read the
company's data protection policy and accepted that the data collected would be used to send them
offers from the company's partners. Hyperlinks provided access to the data protection policy and
the list of partners concerned. The end of the text stated that if users wished to continue without
receiving offers from the company's partners, they could click on a link in the text ("click here").
56. Thus, users confronted with this form can either click on a button to validate their participation in
the game and accept that their data will be used to send them offers from the company's partners,
or click on the "click here" link to continue without receiving these offers.
57. The Restricted Committee took the view that, as designed, the proposed forms did not allow data
subjects to express a valid choice reflecting their preferences regarding the transmission of data
for commercial prospecting purposes. The overall view of the interfaces highlighted in particular
the "VALIDATE", "I VALIDATE" or "I ANSWER QUESTIONS TO APPLY" button, whose
size and colour made it stand out from the other information provided. Similarly, its title was more
suggestive of the conclusion of the user journey rather than the transmission of data to partners.
Finally, its location gave the impression that it had to be clicked to complete the registration and
take part in the competition. On the other hand, the hypertext link making it possible to take part
in the game without agreeing to the transmission of one’s data to the partners was presented in the
body of the text, in characters of a much smaller size than those used for the buttons and without
any particular emphasis, so that it did not appear intuitive that it was possible to take part without
9
clicking on one of the aforementioned buttons and therefore without transmitting one’s data to
third parties for canvassing purposes. The consent obtained was therefore not unequivocal and
free.
58. The Restricted Committee also noted that, as part of its written observations relating to the failure
to comply with Article 6 GDPR, the company produced two other forms, which were presented as
compliant. However, the Restricted Committee noted that their design did not allow the data
subjects to express their consent by a clear and unambiguous positive act.
59. On the one hand, the Restricted Committee noted that the presentation of these forms, like those
consulted by the delegation during the on-site inspection, particularly emphasised the
"VALIDATE MY COORDINATES" and "CONTINUE" buttons, to validate participation in the
game and transmit data to the partners. On the other hand, the "click here" hypertext link making
it possible to take part in the game without accepting this transmission was presented in the body
of the text, in characters much smaller than those of the button and without any particular
emphasis. In addition, the overall design of the form accessible from the
website, which contained three green boxes ("I CONFIRM MY ENTRY", "I CONFIRM MY
CONTACT DATA FOR DELIVERY IF I WIN" and "I CONFIRM MY CONTACT DATA")
suggested that there was a logical sequence between these three actions and that the "CONFIRM
MY CONTACT DATA" button was the last button to be activated to enter the game and win.
However, this button was not compulsory, as the user could use the "click here" link, which was
not intuitive given the general appearance of the form.
60. In addition, with regard to the form used by on the
website, the Restricted Committee noted the existence of two
boxes to be ticked, one concerning the reading and acceptance of the rules of the game, the other
concerning the reading of the privacy policy and the acceptance of the transmission of one's data.
The similar appearance of these boxes, presented as legal notices that had to be read, and whose
accompanying text began with "I have read", encouraged users to tick them indiscriminately, then
click on "CONTINUE" when transmitting their data. The option to enter the prize draw without
receiving any promotional offers was available by clicking on the "here" link, but it was written in
a smaller font and was not highlighted in comparison with the "CONTINUE" button, which was
particularly visible due to its size, colour and font, and which also appeared to conclude the user
journey due to its location at the bottom of the form. Thus, the optional nature of the "CONTINUE"
button could not be clearly deduced from the overall design of the form.
61. On the other hand, the Restricted Committee noted that an online check carried out on 17 October
2023 had revealed that, given its configuration, the form referred to in the previous paragraph did
not materially allow the user to take part in the game without accepting the transmission of his
data to the company's partners, and therefore without being the recipient of commercial
canvassing, contrary to what was indicated on the form.
62. The Restricted Committee therefore took the view that the aforementioned forms did not
sufficiently inform data subjects that they were consenting to the transmission of their data for the
purposes of commercial canvassing, in a context where the very purpose of these websites was to
10
offer the prospect of gains that could not suggest the objective of collecting this data on a
permanent basis for such purposes. These people were not in a position to express their consent in
a clear and unambiguous positive act.
63. Under these conditions, the Restricted Committee took the view that did not
have valid consent within the meaning of Articles L34-5 CPCE and 4 GDPR to carry out its
commercial prospecting operations by electronic means.
64. A breach of Article L34-5 of the CPCE is thus established.
D. On the breach of the obligation to process data lawfully
65. Pursuant to Article 6 GDPR, “1. Processing shall be lawful only if and to the extent that at least
one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more
specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or
in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is
subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another
natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in
the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or
by a third party, except where such interests are overridden by the interests or fundamental rights
and freedoms of the data subject which require protection of personal data, in particular where
the data subject is a child.”
66. The Restricted Committee pointed out that commercial canvassing by telephone could be carried
out on the legal basis of the company's legitimate interest (f) or on the basis of consent (a).
67. In the case in point, the company stated that it had carried out commercial canvassing by telephone,
using prospect files purchased from several data suppliers.
68. The Restricted Committee noted that the company had been unable, either in its written
observations or in its oral observations at the meeting, to indicate precisely what legal basis it had
had for carrying out such processing. In these circumstances, the two legal bases likely to be
applicable in this case will be examined in turn.
11
1) On legitimate interest
69. The Rapporteur maintained that the company could not rely on the legal basis of legitimate
interest referred to in Article 6(1)(f) GDPR as a basis for its commercial canvassing by telephone.
Thus, with regard to the online competition entry forms through which collected the
data of prospective customers that it sold to it pointed out that
was not systematically mentioned in the list of partners likely to approach the
data subjects, and that the latter could not legitimately expect to receive commercial offers from
this company.
70. In defence, the company relied on contractual commitments, which stipulated that
had to be mentioned among the recipients of the data collected. It took the
view that it could not be held liable for the failings of its service provider, and produced an example
of a form used by containing a URL link to a list of partners, including (a link
to privacy policy giving access to the full list of companies belonging to the same group
as including Finally, the company stated that it carried out regular
checks on the conformity of the files delivered.
71. The Restricted Committee reiterated that, while commercial canvassing by non-electronic means
might be carried out on the basis of the company's legitimate interest, the latter had to ensure that
the processing did not adversely affect the rights and interests of the persons whose data was
processed, taking into account their reasonable expectations.
72. In this respect, recital 47 GDPR provides that: “[…] the existence of a legitimate interest would
need careful assessment including whether a data subject can reasonably expect at the time and
in the context of the collection of the personal data that processing for that purpose may take
place. The interests and fundamental rights of the data subject could in particular override the
interest of the data controller where personal data are processed in circumstances where data
subjects do not reasonably expect further processing […].”
73. In the case in point, the Restricted Committee noted that some of the competition forms used by
to collect data from prospective customers, which it then transmitted to
did not allow the data subjects to reasonably expect to receive commercial
prospecting offers from this company.
74. Thus, with regard to the form accessible from the , website, the Restricted
Committee noted that it contained a hypertext link to a list of partners by name and not to categories
of partners. Thus, data subjects might therefore legitimately expect this list of partners to be
exhaustive. However, said list did not mention
75. Concerning the forms on the websites (this form refers to the website
and , the Restricted Committee noted that they
did not mention the list of partners or categories of partners to whom the data might be transmitted,
and that they also did not contain any link allowing access to such a list.
12
76. Moreover, with regard to the checks that the company claimed to carry out on the forms from
which the data was collected, the Restricted Committee noted that it had not produced any
evidence to support this, as the contractual commitments of its suppliers did not constitute a control
measure as such.
77. The Restricted Committee took the view that, in these circumstances, the protection of the
interests, freedoms and fundamental rights of the data subjects took precedence over the legitimate
interests of the company, and that the latter could not therefore rely on the legal basis mentioned
in Article 6(1)(f) to justify its telephone canvassing operations.
2) On consent
78. The Rapporteur took the view that the company could not rely on the legal basis of consent referred
to in Article 6(1)(a) GDPR as a basis for its commercial canvassing by telephone. She relied on
the same arguments as those developed for the breach of Article L34-5 GDPR, with regard to the
collection forms used by data providers.
79. In defence, the company relied on the terms of the contract with She took note of
the observations made, but pointed out that, while there were shortcomings, they were not
indicative of a desire to disregard its obligations, or of widespread practices. She provided two
examples of collection forms used by its suppliers, which she considered to be compliant. Lastly,
she reported on the inspections carried out on the files after they had been made available by the
service provider and insisted on the impossibility, given the volume of these files, of carrying out
a unitary inspection.
80. Firstly, the Restricted Committee pointed out that, while the intentional nature of the breach had
to be taken into account when deciding whether a fine should be imposed and the amount of the
fine, it had no bearing on the nature of the breach, which might be the result of negligence. The
same applies to the generalised nature or otherwise of said breach.
81. Secondly, with regard to the methods used to obtain consent for telephone canvassing, the
Restricted Committee took the view that the forms used by the suppliers of
did not allow valid consent to be obtained within the meaning of Article 6(1)(a) GDPR, as
explained in points 47 to 63 of these deliberations with regard to electronic canvassing.
82. Thirdly and finally, with regard to the inspections that the company claimed to have carried out
on the files delivered, the Restricted Committee noted that the company had not produced any
evidence of this.
83. Firstly, in its written observations of 29 September 2023, and then in its oral observations at the
meeting of 7 December 2023, the company referred to a document entitled
, collected during the on-site inspection and which, according to the company,
referred to "checks on prospecting files carried out after they had been made available by the
service provider". In deliberation No SAN-2023-019 of 14 December 2023, the Restricted
Committee asked the Rapporteur and the company to produce this document.
13
84. The Restricted Committee noted that the file produced by the Rapporteur, whose digital footprint
attested that it was indeed the file from which the findings had been made by the delegation during
the inspection, did not contain any evidence likely to attest to the verifications invoked by the
company. As mentioned in the inspection report, this is a leads file delivered by to the
on 23 September 2021, containing the data of approximately 15,000 leads.
Although each of these leads contained a URL link to the source of the data, the Restricted
Committee noted that there was no mention of any checks that might have been carried out by
or the . At the meeting on 18 January 2024, the company
indicated that it did not question the integrity of this document.
85. With regard to the file produced by the company, the Restricted Committee noted that it did not
correspond to the one collected during the inspection, insofar as its digital footprint and size
differed. It also noted that this difference was confirmed by its content since, contrary to the
findings in the minutes of 23 September 2021, it contained no prospect data but only URL links
accompanied by comments ("ok", "only one box to tick", "contentious").
86. Finally, the Restricted Committee noted that the content of the file produced did not appear to be
consistent with the stated purpose insofar as the summary and undated comments appearing therein
were not linked to any lead sheet and that it had not been demonstrated that the non-conformities
identified would have been reported to The Restricted Committee therefore took the
view that, in any event, such a file did not make it possible to demonstrate the existence of checks
carried out on the files delivered.
87. On the other hand, with regard to the other documents in the file, the Restricted Committee noted
that they attested exclusively to requirements imposed by on
before the resumption of their contractual relations, without constituting controls by
on the subsequent practices of its service provider.
88. Lastly, the Restricted Committee noted that the proportion of non-compliant files among those
randomly examined by the delegation (i.e. four non-compliant files out of the seven examined)
demonstrated the inadequacy of the measures taken by the company to ensure the validity of the
consent of the data subjects.
89. Thus, the Restricted Committee took the view that the forms referred to in the present deliberation
did not enable to obtain valid consent from the data subjects. It pointed out
that, in light of the forms produced by the company in its observations of 29 September 2023, the
breach identified was persistent.
90. Consequently, in the absence of a legal basis allowing to base its commercial
canvassing operations by telephone, the Restricted Committee took the view that there had been a
breach of Article 6 GDPR.
E. On the breach of the obligation of transparency and to provide information to
individuals
14
91. Article 14(1) GDPR lists the information to be communicated by the controller to data subjects
where their personal data has not been collected from them, including the purposes of the
processing as well as its legal basis.
92. Paragraph 2 of the same Article provides that in “[I]n addition to the information referred to in
paragraph 1, the controller shall provide the data subject” with certain information “necessary
to ensure fair and transparent processing in respect of the data subject”, in particular the rights
available to the data subject, the retention period of the data, the source from which it originates
or the right to lodge a complaint with a supervisory authority.
93. The Rapporteur noted that people who were the subject of commercial canvassing by telephone
on the part of (i.e. approximately 1.3 million prospective customers in France
and Belgium between May 2022 and May 2023) were not informed of all the compulsory
information provided for in the aforementioned Article 14. It observed that, while prospective
customers were informed that the call would be recorded and that they might object to this
recording and register with Bloctel, they were not given all the other information, nor were the
data subjects given the opportunity to obtain more complete information.
94. The company has not submitted any defence observations on this point.
95. The Restricted Committee pointed out that, insofar as the company had indicated that it carried
out commercial canvassing by telephone on the basis of files transmitted by its partners, this was
a case of indirect collection, for which the provision of information to individuals had to be ensured
under the conditions defined in Article 14 GDPR.
96. It noted, by way of clarification, that the EDPB stated, in his guidelines on transparency within the
meaning of Regulation (EU) 2016/679, that while multi-level information was possible for greater
clarity, it "recommends that the first level (in other words, the main way of communicating for the
first time with a data subject) should communicate the most important information in general […]
For example, when the first contact with a data subject is made by telephone, this information
could be provided during the telephone call while the other information required under Articles
13 and 14 could be provided at a later stage and by other means, in particular by sending a copy
of the privacy policy by email and/or by sending the data subject a link to the controller's online
privacy notice/statement at different levels". With regard to the obligation to provide information
in a telephone environment, it is suggested that "oral explanations provided by a natural person
allowing interaction, [questions requiring an answer, or] automated or pre-recorded information
offering the option of hearing other more detailed information" should be implemented.
97. The Restricted Committee noted that it was clear from the telephone recordings provided by the
company that people who were the subject of telephone canvassing were only informed that the
call had been recorded and that they could register with Bloctel, without being given any other
information about the processing of their personal data.
98. The Restricted Committee also noted that these people were not offered any possibility of
obtaining more complete information, for example by pressing a button on their telephone keypad.
15
99. In these circumstances, the Restricted Committee took the view that there had been a breach of
Article 14 GDPR.
F. On the breach of the obligation to ensure data security
100. Pursuant to Article 32(1) GDPR, “taking into account the state of the art, the costs of
implementation and the nature, scope, context and purposes of processing as well as the risk of
varying likelihood and severity for the rights and freedoms of natural persons, the controller and
the processor shall implement appropriate technical and organisational measures to ensure a level
of security appropriate to the risk […]” and in particular “the ability to ensure the ongoing
confidentiality, integrity, availability and resilience of processing systems and services” and “a
process for regularly testing, assessing and evaluating the effectiveness of technical and
organisational measures for ensuring the security of the processing”.
101. The Rapporteur noted that the company had indicated that it would retain the data of customers
of its sales outlets in Europe, i.e. 104,391 people in November 2021, for a period of five years
from the date of closure of the contract, in accordance with the legal limitation periods, specifying
that this data was kept in an active database, without any intermediate archiving mechanism being
implemented. The Rapporteur took the view that these retention arrangements did not make it
possible to limit access to data to users who needed to know it, insofar as persons with an interest
in having access to this data during the term of the contract continued to have unrestricted access
to it for a period of five years, even after the end of the contract, even though their duties no longer
necessarily required them to know it.
102. In defence, the company pointed out that each had its own customer database,
and that vendors could therefore only access customer information for the store to which they were
attached. With regard to support services, it confirmed that they had access to all
network customer data. Furthermore, it did not dispute that at the end of the
contractual relationship, there was no restriction on access, and specified that certain services, in
particular after-sales service, were managed by the vendors themselves. Lastly, in its oral
observations at the meeting on 7 December 2023, it pointed out that although
created in 2017, began rolling out its stores in 2021, and that no data had therefore been kept for
five years.
103. The Restricted Committee pointed out that it followed from the provisions of Article 32 GDPR
that the controller had to implement appropriate measures to ensure the confidentiality of data and
prevent it from being processed unlawfully by persons who had no need to know (CNIL, FR, 29
October 2021, Sanction, No SAN-2021-019, published).
104. This need to know was likely to change depending on the life cycle of the data and the purposes
for which it was stored. Thus, during the phase of their current use, which corresponded to the
time required to achieve the specified purpose, the data was kept in an "active base" and was
accessible to all departments responsible for implementing the processing. At the end of this phase,
when the data was no longer used to achieve the objective set but was still of administrative interest
16
to the organisation (e.g. for the management of any dispute) or had to be retained to meet a legal
obligation, it had to be possible to consult it only on a one-off basis and for a reason, by specifically
authorised persons involved in the objective that justified its retention, and it had to be subject to
intermediate archiving. This intermediate archiving required separation from the active database,
which might be physical (by transferring the data to a dedicated archive) or logical (by putting in
place technical and organisational measures to ensure that only people with an interest in
processing the data by virtue of their duties could access it).
105. The Restricted Committee noted that the company did not dispute that it retained its customers'
data at the end of the contractual relationship, without taking any intermediate archiving measures.
The Restricted Committee reiterated that the termination of contractual relations had to result in
access to data being restricted to certain employees by virtue of their duties. However, the
Restricted Committee took the view that, as things stood, the information in the file did not make
it possible to establish that persons would have had access to said data without having a need to
know.
106. It followed from the foregoing that there was no breach of Article 32 GDPR.
III. On the pronouncement of corrective measures and publicity
107. Pursuant to Article 20(III) of the Act of 78-17 January 6 (1978) as amended: "Where the controller
or its processor fails to comply with the obligations resulting from Regulation (EU) 2016/679 of
27 April 2016 or from this Act, the Chairman of the CNIL may […] refer the matter to the
Restricted Committee of the Commission with a view to pronouncing, after adversarial
proceedings, one or more of the following measures: […] 7° With the exception of cases where
the processing is implemented by the State, an administrative fine not exceeding €10 million or, in
the case of a company, 2% of the total annual worldwide revenue for the previous accounting
period, whichever is greater. In the cases referred to in Article 83(5) and (6) of Regulation (EU)
2016/679 of 27 April 2016, these ceilings are increased to €20 million and 4% of said revenue
respectively. In determining the amount of the fine, the Restricted Committee will take into account
the criteria specified in Article 83.”
108. Article 83 GDPR provides that: “Each supervisory authority shall ensure that the imposition of
administrative fines pursuant to this Article in respect of infringements of this Regulation referred
to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and
dissuasive”, before specifying the elements to be taken into account in deciding whether an
administrative fine should be imposed and in deciding the amount of this fine.
109. Firstly, the Restricted Committee pointed out that, when imposing an administrative fine, it had
to take into account the criteria set out in Article 83 GDPR, such as the nature, seriousness and
duration of the breach, whether or not the breach had been deliberate, the measures taken by the
controller to mitigate the damage suffered by data subjects, the degree of cooperation with the
supervisory authority and the categories of personal data affected by the breach.
17
110. The Restricted Committee emphasised that the company's breaches concerned obligations relating
to the fundamental principles of personal data protection.
111. Thus, with regard to obtaining consent for prospecting purposes by electronic means, the
Restricted Committee insisted on the fact that the ecosystem of the resale of data from partners to
partners required particularly strong guarantees as to the quality and validity of the consent
obtained by the primary data collector and used by the partners for canvassing purposes. It stressed
that in this respect, an organisation that relied on such consent to carry out commercial canvassing
assumed an essential responsibility requiring it, as the controller, to ensure that the conditions
enabling it to carry out said operations were met, independently of the possible responsibility of
the data suppliers, the primary data collectors. In addition, it took the view that the requirements
had to be particularly stringent with regard to the procedures for obtaining the consent of users of
websites whose purpose was to offer the prospect of gain, as these people were not necessarily
aware of the scope of their agreement when they registered. It also notes that the company made
extensive use of electronic canvassing, having sent more than 1.3 million text messages between
September 2020 and September 2021, and more than 220,000 between May 2022 and May 2023,
and that such practices were likely to be perceived as particularly intrusive.
112. With regard to the breach of the obligation to have a legal basis for processing the data of
prospects in the context of telephone marketing, the Restricted Committee reiterated the
importance, in the absence of valid consent, of enabling data subjects to assess the extent of the
processing to which their data was likely to be subjected. Thus the fact that, at the time the data
was collected, a detailed list of partners likely to carry out commercial prospecting operations was
made available to the data subjects, without being included, and without this
list being supplemented by a statement specifying the categories of partners to which
could belong, deprived the data subjects of the minimum basis of information
enabling their interests, freedoms and fundamental rights to be safeguarded.
113. With regard to the breach of the obligation to inform individuals, the Restricted Committee
noted that the company had used data obtained on a massive scale from data brokers, without in
particular allowing the data subjects to ascertain the source of the data collected. It pointed out that
informing people was a fundamental measure enabling them to exercise the rights they enjoyed,
and that such a failure was therefore particularly serious. Lastly, it pointed out that this failure
appeared to be structural, insofar as none of the dozens of call recordings provided by the company
met the information requirements set out in Article 14 GDPR.
114. Finally, the Restricted Committee emphasised that as a subsidiary of
had sufficient human, financial and technical resources to ensure compliance with the rules
on the protection of personal data.
115. In view of all these factors, the Restricted Committee took the view that an administrative fine
should be imposed for the breaches of Articles L34-5 CPCE and Articles 6 and 14 GDPR.
116. Secondly, with regard to the amount of the fine, the Restricted Committee pointed out that the
breaches identified in the case in point concerned breaches of principles that might be subject,
18
under Article 83 GDPR, to an administrative fine of up to €20 million or up to 4% of the worldwide
annual revenue for the previous accounting period, whichever was higher.
117. It took the view that the company's business and financial situation should be taken into account.
In this respect, it noted that had achieved revenue of more than
for 2021, with a profit of more than . In addition, the Restricted Committee noted that
the number of stores had risen from in September 2021 to in May 2023,
up 56%.
118. Consequently, in view of the company's liability, its financial capacity and the relevant criteria of
Article 83(2) GDPR referred to above, the Restricted Committee took the view that a fine of five
hundred and twenty-five thousand euros (€525,000) appeared justified.
119. Thirdly, with regard to the publication of the sanction, the Restricted Committee took the view
that this was justified in view of the seriousness of some of the breaches in question, the company's
position on the market, the scope of the processing and the number of data subjects.
120. It also pointed out that the purpose of this measure was to inform the data subjects by the
company's canvassing operations. This provision of information would enable them to assert their
rights if necessary.
121. Lastly, it took the view that this measure was proportionate given that the decision would no longer
identify the company by name two years after publication.
19
CONSEQUENTLY
The Restricted Committee of the CNIL, after deliberation, decided to:
• order to pay an administrative fine of five hundred and twenty-
five thousand euros (€525,000) for breaches of Article L34-5 of the French Post and
Electronic Communications Code and Articles 6 and 14 GDPR, which breaks down
as follows:
➢ two hundred thousand euros (€200,000) for breach of Article L34-5 of the
French Postal and Electronic Communications Code;
➢ three hundred and twenty-five thousand euros (€325,000) for breaches of
Articles 6 and 14 GDPR;
• make public, on the CNIL website and on the Légifrance website, its deliberation,
which would no longer allow the company to be identified by name at the end of a period
of two years from its publication.
The Chairman
Philippe-Pierre CABOURDIN
This decision may be appealed before the Council of State within two months of its notification.
20