Deliberation of the Restricted Committee No SAN-2024-014 of 26 September 2024
concerning
The Commission nationale de l’informatique et des libertés (French Data Protection Authority),
meeting in its Restricted Committee composed of Mr Philippe-Pierre Cabourdin, President, Mr
Vincent Lesclous, Vice-President, Ms Laurence Franceschini, Ms Isabelle Latournarie-Willems
and Mr Alain Dru, members;.
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 on the protection of personal data and on the free movement of such data (hereinafter
“GDPR”);
Having regard to the French Postal and Electronic Communications Code;
Having regard to the French Data Protection Act no. 78-17 of 6 January 1978, and in particular
Articles 20 et seq.;
Having regard to Decree No 2019-536 of 29 May 2019 implementing Law No 78-17 of 6 January
1978 on data processing, data files and individual liberties;
Having regard to deliberation No 2013-175 of 4 July 2013 adopting the internal regulations of the
CNIL (French Data Protection Authority);
Having regard to decision No 2021-270C of 4 October 2021 of the President of the CNIL to
instruct the Secretary General to carry out or have carried out a verification mission of the
processing operations implemented by and or on their behalf, in any place
likely to be concerned by their implementation;
Having regard to the decision of the President of the CNIL of 16 November 2023 appointing a
Rapporteur to the Restricted Committee;
Having regard to the report of Ms Sophie Lambremon, Commissioner-Rapporte, served on
on 1 March 2024;
Having regard to the written observations submitted by on 2 April 2024;
Having regard to Decision No 2024-093C of 22 April 2024 of the President of the CNIL to instruct
the Secretary General to carry out or have carried out a mission to verify any processing accessible
from the domain “ ” or relating to personal data collected from the latter;
Having regard to the Rapporteur’s reply to these observations, notified to the company on 30 April
2024;
Having regard to the written observations submitted by Cosmospace on 30 May 2024;
Having regard to the closure of the investigation, notified to the company on 10 June 2024;
1
Having regard to the letters sent by the company to the registry of the sanctions and litigation
department and to the President of the Restricted Committee on 24 June 2024;
Having regard to the oral observations made at the Restricted Committee session on 4 July 2024;
Having regard to the other documents in the case file;
The following were present at the Restricted Committee meeting:
- Ms Sophie Lambremon, auditor, whose report was read out;
As representatives of :
- Maître , lawyer at the Paris bar;
- Maître , lawyer at the Paris bar;
having had the floor last;
The Restricted Committee implemented the following decision:
I. FACTS AND PROCEEDINGS
1. (hereinafter “the company”), whose registered office is located at
, is a simplified joint stock company offering remote divinatory art
services (tarot, horoscope, fortune telling), free or paid. As at 30 November 2021, it had 154
employees.
2. Between March 2021 and March 2022, it generated revenue of around € and net income of
€ . The following year, revenue came to approximately € , with a net loss of € .
3. The company offers, primarily, personalised telephone consultation services provided by salaried
or independent remote advisors, some of whom are located outside France (in Spain but also in
countries outside the European Union, such as Bali, Tunisia or the United States). While the
majority of calls received come from users established in France, the information provided by the
company shows that approximately 5% come from other EU countries or third countries.
4. In addition, the company publishes several websites, including the website
, as well as several mobile apps. These websites and apps offer, in addition
to voice services by telephone, voice services by instant conversation (chat) or by text message,
provided by its partner . The latter is also in charge of the development, supply and
maintenance of the IT and digital services of , which is its main client. Relations
between the two companies are governed, on the one hand, by a processing contract and, on the
other, by a joint responsibility agreement concerning the processing of a certain amount of personal
data.
5. In order to promote its offers, carries out commercial prospecting campaigns by email
and text message, both with its customers and with prospective customers whose contact details
2
have been obtained either directly by (mainly via its websites), or by
(which also manages its own websites, which offer fortune telling services by telephone provided
by ).
6. To this end, has its own database (“ ” database, which included, as of 7 December
2021, a little more than 673,000 unique contacts with the status of customers and a little more than
278,000 with the status of prospects), but also a database common with (“
database), containing the data of all the customers and
prospects of the two companies, which represented, as of 6 October 2022, more than 7 million
contact records for more than 1.5 million unique individuals.
7. In the first three quarters of 2022, said it had sent nearly 6.3 million text messages
and more than 75.6 million marketing emails.
8. On 15 November 2021, a delegation of the Commission nationale de l’informatique et des libertés
(hereinafter “the CNIL” or “the Commission”) carried out an online inspection from five websites
published by and . Its purpose was to verify compliance with the
provisions of French Data Protection Act No 78-17 of 6 January 1978 (hereinafter the “French
Data Protection Act” or “amended Act of 6 January 1978”) and the other provisions relating to the
protection of personal data set forth by legislative and regulatory texts, European Union law and
France’s international commitments. The report drawn up at the end was notified to
on 22 November 2021.
9. An on-site inspection was also carried out on 7 and 8 December 2021 at the premises of the
aforementioned companies. The related reports were notified to on 10 December
2021.
10. The company provided the delegation with additional information on 20 December 2021, 26
January, 25 February, 30 May, 5 August and 12 October 2022.
11. On 16 November 2023, the President of the Commission appointed Sophie Lambremon as
Rapporteur on the basis of Article 22 of the amended Act of 6 January 1978.
12. In accordance with Article 56 of Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of personal data and on the free movement of such data
(hereinafter “GDPR”) and in view of the elements of the file, the CNIL, on 27 April 2023, informed
all the European supervisory authorities of its competence to act as lead supervisory authority
concerning cross-border processing implemented by the company, resulting from the fact that the
company’s main establishment was located in France. After exchanges between the CNIL and the
European data protection authorities within the framework of the one-stop-shop mechanism, it
appeared that the German, Austrian, Belgian, Croatian, Danish, Spanish, Greek, Italian,
Luxembourg, Maltese, Dutch, Polish, Portuguese, Romanian, Slovenian and Swedish authorities
were concerned by the processing carried out, with persons residing in these member states having
used the fortune telling services offered by the company by telephone.
3
13. On 1 March 2024, at the end of her investigation, the Rapporteur sent the company a report
detailing the breaches of Articles 5(1)(c), 5(1)(e) and 9(2) GDPR and Article L34-5 of the French
Post and Electronic Communications Code (hereinafter “CPCE”) that she considered to have
occurred in the case in point. This report proposed that the Restricted Committee impose an
administrative fine on the company. It also proposed that this decision be made public but that it
would no longer be possible to identify the company by name at the end of a period of two years
from its publication.
14. On 2 April 2024, the company submitted its observations in response to the sanction report.
15. On 23 April 2024, at the request of the Rapporteur and pursuant to Article 39 of the Decree of 29
May 2019, a delegation from the CNIL carried out a new on-line inspection from the
website.The report drawn up at the end was notified to on 30 April 2024.
16. On the same day, the Rapporteur responded to the company’s observations of 2 April.
17. On 30 May 2024, the company submitted further observations in response.
18. On 10 June 2024, pursuant to Article 40-III of Decree No 2019-536 of 29 May 2019 implementing
the Data Protection Act (hereinafter “the Decree of 29 May 2019”), the Rapporteur informed the
company and the President of the Restricted Committee that the investigation had been closed.
19. On the same day, the company was informed that the file had been placed on the agenda of the
Restricted Committee session of 4 July 2024.
20. The Rapporteur and the company made verbal observations at the Restricted Committee session.
4
II. REASONS FOR THE DECISION
A. With regard to the European cooperation procedure
21. Under Article 4(23)(b) GDPR, "cross-border processing" means, in particular, "processing of
personal data which takes place in the context of the activities of a single establishment of a
controller or processor in the Union but which substantially affects or is likely to substantially
affect data subjects in more than one Member State".
22. The Rapporteur considers that the company implements cross-border processing of personal data
insofar as some of its customers access the services offered from other EU countries. She thus
notes that the company sent the delegation a document stating the number of telephone
consultations issued each month, with a breakdown of customers by country, which attests to the
cross-border nature of the processing.
23. In its defence, the company considers that the CNIL wrongly informed its European counterparts
of the procedure followed against it and that the application of the cooperation mechanism was not
appropriate. It indicates first of all that the company’s services are exclusively provided in French
and that the content of its website is only accessible in this language. Then, while it admits that it
may happen, “exceptionally and marginally”, that certain French customers access the company’s
services from abroad, it considers that they are not themselves foreign, based on the place of birth
of the data subjects. It considers that, given these elements, only the Belgian authority could
possibly be concerned.
24. The Restricted Committee notes that it emerges from the elements in the file that, in the context
of the consultation consultations delivered by telephone, the company received each month, over
2022, between 350 and 400 calls from different EU countries. This circumstance is sufficient to
establish the existence of cross-border processing, insofar as it affects or is likely to significantly
affect data subjects in several member states, within the meaning of Article 4(23)(b) GDPR,
notwithstanding the language in which these individuals express themselves, their nationality or
even their place of birth.
25. Pursuant to Article 60(3) GDPR, the draft decision adopted by the Restricted Committee was
forwarded to the other competent European supervisory authorities, with a view to enabling them
to make relevant and reasoned objections to the processing operations and breaches which concern
them, on 22 August 2024.
26. As of 19 September 2024, none of the supervisory authorities concerned had raised any relevant,
reasoned objection to this draft decision so that, pursuant to Article 60(6) of the GDPR, they are
deemed to have approved it.
5
B. On the procedure followed before the Restricted Committee
1) On the objection based on the lack of knowledge of the right to a fair trial
27. The company first argues that, in the context of the proceedings before the CNIL, the adversarial
principle was not respected. It states that it only became aware of the document entitled “IMI
REPORT – Number: – Article 56 – Identification of the LSA and CSA”, in which the
CNIL informs the supervisory authorities concerned that a sanction procedure has been initiated,
when it consulted the file at the CNIL’s offices on 10 June 2024. It considers that, as the closure
of the investigation was notified to it on the same day, it was not able to present its observations
on this point.
28. It also considers, more generally, that the elements of the file have not been discussed and that no
debate could take place insofar as, since the inspection, it has not been given formal notice to
change its practices.
29. Lastly, the company criticises the Rapporteur for having investigated this case exclusively on the
basis of the charges brought against it.
30. The Restricted Committee recalls, firstly, that the adversarial principle implies the right of the
parties to be notified of and to be able to discuss any exhibits or observations submitted to the
judge with a view to influencing his decision (ECHR, Grand Chamber, 20 February 1996,
Vermeulen v.Belgium, No 19075/91).
31. The Restricted Committee recalls, on the one hand, that pursuant to Article 40-III of Decree No
2019-536 of 29 May 2019, the decision to close the procedure belongs to the Rapporteur, when
she considers the case as is. In the case in point, it should be noted that the Rapporteur took this
decision on 10 June 2024, considering that the debate was exhausted after several exchanges of
submissions with the company, the latter having made its observations last. These exchanges
include the documents on which the Rapporteur has based her characterisation of the breaches that
she is proposing to the Restricted Committee.
32. The Restricted Committee also notes that the document entitled “IMI REPORT – Number:
– Article 56 – Identification of the LSA and the CSA”, which is merely an informative
document in the context of the procedure for cooperation between supervisory authorities, is one
of the documents in the procedural file. It notes that the company was informed of the possibility
of reading and copying all the documents of said file when the sanction report was served on 1
March 2024. However, the Restricted Committee notes that it was only on 30 May 2024, after
sending its second observations in defence, that the company asked to be able to exercise this right,
with the consultation having been organised on 10 June 2024.
33. In any event, the Restricted Committee notes that the company was able to present its oral
observations on the aforementioned document at the meeting of 4 July 2024, which, moreover, led
the Restricted Committee to suspend the session and deliberate on this point before continuing the
discussions. The Restricted Committee also recalls that the entire file of the procedure was also
6
made available to it before the session. It follows from all the foregoing that the members of the
Restricted Committee were able to have all the elements enabling them to make their decision.
34. Under these conditions, the Restricted Committee considers that the adversarial principle has not
been disregarded. With regard more generally to the conduct of the proceedings, the Restricted
Committee notes that it was conducted on a regular basis, the company having been able to present
its observations, first in writing within the framework of the investigation, then orally during the
Restricted Committee session of 4 July 2024, in accordance with the procedural rules set out in
Articles 22 of the French Data Protection Act, 39 to 45 of the Decree of 29 May 2019 and 61 to
70-1 of the CNIL internal regulations.
35. Secondly, the provisions of Article 20-IV of the French Data Protection Act provide that the
decision to refer the matter to the Restricted Committee falls within the powers of the President of
the CNIL, without such a decision being conditional on the issuance of a prior formal notice (EC,
10th, 26 April 2022, Optical Center, No 449284, unpublished).
36. Thirdly and finally, the Restricted Committee notes that, in preparing her report, the Rapporteur
relied on the information gathered during inspections, carried out in compliance with the
provisions of the French Data Protection Act, and that she examined the facts observed in light of
the applicable rules on the protection of personal data. The Restricted Committee thus considers
that no element is likely to reveal an unfavourable bias of the Rapporteur towards the company.
37. Consequently, in view of all the foregoing, the company is not entitled to argue that the
proceedings against it disregarded its right to a fair trial
2) On the online inspection of 23 April 2024
38. The company considers that the documents relating to the online inspection carried out on 23
April 2024 from the website must be excluded from the proceedings, insofar as this
website does not belong to .
39. The Restricted Committee notes that, by decision No 2021-270C of 4 October 2021, the President
of the CNIL instructed the Secretary General to carry out or have carried out a verification mission
of the processing operations implemented by and .
40. Pursuant to this decision, a CNIL delegation carried out, on 15 November 2021, an online
inspection from several websites published by these two bodies. The findings made revealed that
implemented, on its website, a form enabling it to collect user data for
commercial prospecting purposes.
41. In the context of its exchanges with the supervisory delegation, indicated that it had
set up, with its partner , a common database enabling them to send prospecting emails
and text messages indifferently to the customers and prospects of either of the companies.
42. In her report, notified to on 1 March 2024, the Rapporteur argued that the latter could
not, in order to carry out its prospecting operations, avail itself of the consent obtained by
7
via the form implemented on this company’s website , on the grounds that
no list of partners (mentioning ) was easily accessible. She considered that this
constituted a breach of Article L34-5 CPCE.
43. In its observations in response of 2 April 2024, responded on this point and indicated
in particular that, since the online inspection of 15 November 2021, the form on the
website had been modified. In this regard, it provided a screenshot of this new form.
44. Within the framework of the powers granted to her by Article 39(4) of the Decree of 29 May 2019,
the Rapporteur requested the carrying out of a new inspection, with the aim of verifying the
compliance of the form mentioned by in its observations in response.
45. By decision No 2024-093C of 22 April 2024, the President of the CNIL instructed the Secretary
General to carry out or have carried out a mission to verify any processing accessible from the
domain “ ” or relating to personal data collected from it.
46. It was under these conditions that a CNIL delegation carried out a new online inspection of this
site, on 23 April 2024.
47. The Restricted Committee notes that, insofar as processes data collected from the
website, the inspection referred to appears perfectly justified. It further notes that
was notified of the inspection report on 30 April 2024. Moreover, it observes that the
inspection decision of 22 April 2024 does not concern or , but rather the
domain .
48. Under these conditions, there is no need to dismiss the exhibits relating to the online inspection of
23 April 2024.
C. On the breaches noted
1) On the breach of the obligation to ensure the adequacy, relevance and non-excessive
nature of the data pursuant to Article 5(1)(c) GDPR
49. Article 5(1)(c) GDPR provides that personal data must be “adequate, relevant and limited to what
is necessary in relation to the purposes for which they are processed (‘data minimisation’)”.
50. The Rapporteur considers that the full and systematic recording of telephone conversations
between fortune tellers and customers, between switchboard operators and fortune tellers and
between switchboard operators and customers or prospective customers is excessive in relation to
the purposes of training, evaluation and quality control, and that it should be limited to a sample
of conversations between the aforementioned individuals, with the exception of conversations
between switchboard operators and customers or prospective customers, for which the recording
should relate only to the part clearly concerning the conclusion of a contract.
8
51. In its defence, the company considers, firstly, that although the recordings in question do contain
personal data, they are not subsequently processed in any way.
52. Secondly, the company believes that it already carries out minimisation operations, on the one
hand by deleting each evening, at the end of the service, 50% of the recordings of conversations
between fortune tellers and customers and between fortune tellers and switchboard operators and,
on the other hand, by not recording any information relating to its customers’ bank details.
53. Thirdly, it discusses each of the purposes that, in its view, govern the recording of telephone
conversations. First of all, it considers that the complete and systematic recording of conversations
is necessary for quality control and training purposes, given the nature of its activity and the
diversity of consultations delivered. Secondly, it considers that in the event of a legal challenge to
its services, it has no other means to demonstrate the subscription and proper performance of the
contract. The company further argues that it regularly receives judicial requisitions requesting it
to communicate the recordings made and that it is therefore obliged to respond to them, under
penalty of criminal sanction. Finally, it considers that these recordings are necessary for the
purpose of safeguarding human life, arguing that they would enable it to assess the situations in
which the emergency services should be contacted.
54. The Restricted Committee notes that it emerges from the elements of the file that
records in an integral and systematic manner, on the one hand, conversations between the fortune
tellers providing the consultation and the customers, as well as conversations between the
switchboard operators and the fortune tellers (in the context of the transfer of calls from a customer
to a fortune teller, or when the fortune tellers sends the customer to the switchboard at the end of
the consultation). Every evening, at the end of the service, 50% of these recordings are
automatically deleted. The others are retained for a period of six months (except in the event of
litigation).
55. And on the other hand, the company records all conversations between the switchboard operators
and the customers or prospects (with the exception of the part relating to the collection of the
customer’s bank details), which it keeps for 13 months.
56. First of all, Article 4(2) GDPR defines processing as “any operation or set of operations which is
performed on personal data or on sets of personal data, whether or not by automated means, such
as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, restriction, erasure or destruction”.
9
57. Pursuant to these provisions, the recording of telephone conversations constitutes, in itself, the
processing of personal data. The Restricted Committee has also sanctioned, on several occasions
and for several years, organisations carrying out such recordings under conditions that do not
comply with GDPR (CNIL, FR, Sanction, 21 November 2019, SAN-019-010, published; CNIL,
FR, Sanction, 28 July 2020, SAN-2020-003, published; CNIL, FR, Sanction, 8 June 2023, SAN-
2023-008, published). In addition, the CNIL provides the public with a wide range of content on
this issue on its website. The Restricted Committee notes that this was already the case before
GDPR came into force, with the adoption in 2014 of simplified standard No 57 relating to the
listening to and recording of telephone conversations in the workplace.
58. The Restricted Committee notes that in the case in point, by recording the aforementioned
conversations, the company collects the data of the data subjects – both that of its prospects or
customers and its employees –, retains such data (for a more or less long period, ranging from a
few hours to several months) and, for some, consults and uses such data for various purposes that
it details (training and quality control of the service, judicial requisitions, disputes, etc.). Thus the
company carries out various processing operations as detailed in Article 4(2) GDPR.
59. While it appears established that the company carries out, each evening, the random and automatic
deletion of 50% of some of the recordings made, the Restricted Committee emphasises that this
circumstance has no impact on the qualification of these processing operations, with this deletion
taking place, by definition, after the collection and processing of the data.
60. Secondly, the Restricted Committee considers that it is necessary to analyse each of the purposes
invoked by the company to carry out the full and systematic recording of the conversations referred
to in paragraph 50 of this deliberation, in order to determine whether the data collected appears to
be adequate, relevant and limited to what is necessary for these purposes.
61. With regard to the full and systematic recording of telephone calls for the purposes of quality
control and training, the Restricted Committee notes first of all that the company does not provide
any evidence to justify the need to record all the aforementioned conversations for this purpose.
The Restricted Committee then considers that the purpose of controlling the quality of the service
provided by the switchboard operators and fortune tellers can be achieved by a less intrusive means
such as a one-off and random recording.
62. Therefore, the Restricted Committee considers that the introduction of a system for the systematic
recording of telephone calls made, on the one hand, between fortune tellers and customers and, on
the other hand, between switchboard operators and customers is excessive with regard to the
purpose pursued.
63. The Restricted Committee recalls that it has already considered, with regard to a company
recording telephone calls made or received by customer service employees for training purposes,
that “the company does not justify the need to record all telephone conversations made by customer
service, with regard to the purpose of the processing, namely employee training. (…). The
Restricted Committee therefore considers, in view of these elements, that a breach of Article
5(1)(c) GDPR is constituted” (CNIL, FR, 28 July 2020, Sanction, SAN-2020-003, published). This
10
position has recently been recalled with regard to a company offering, as in this case, consultation
by telephone (CNIL, FR, 8 June 2023, Sanction, SAN-2023-008, published).
64. Under these conditions, the full and systematic recording of calls does not appear necessary either
for service quality control or for training purposes.
65. With regard to the full and systematic recording of telephone calls as evidence of the conclusion
of a contract, the Restricted Committee reiterated that such recording is possible, provided it is
necessary and in the absence of any other means of proof, such as written confirmation. In this
case, however, the recording must not be complete, with the professional having to provide
mechanisms in order to record the conversation only when its purpose clearly relates to the
conclusion of a contract.
66. The Restricted Committee noted that, in the case in point, the sale of packages or services may
take place during calls between customers and switchboard operators. Insofar as it is the customers
who contact the company and, therefore, this sale does not follow a telephone solicitation, the
contract is concluded orally, without any written confirmation being sent to the customer. Under
these conditions, and in the absence of any other method of proof of subscription of the contract,
the recording of the part of the call relating to the conclusion of the contract appears to be justified.
The Restricted Committee notes, however, that the company is not limited to recording only this
phase of the call, but carries out its full recording, regardless of the different categories of calls
cited above.
67. In its defence, the company argues firstly that the full and systematic recording of conversations
between customers and switchboard operators and between customers and fortune tellers is
necessary for the purpose of proving that the contract has been taken out, insofar as it is all these
exchanges that would make it possible to reach an agreement.
68. The Restricted Committee recalls that pursuant to Article 1121 of the French Civil Code, the
contract is concluded as soon as acceptance of the offer reaches the offeror, i.e., in the case in
point, when the customer agrees, having received the appropriate information (price of the service,
duration, terms, etc.), to use the services of the company.
69. Under these conditions, for calls between switchboard operators and customers, the full and
systematic recording of the call does not appear necessary for the purpose of proving that a contract
has been taken out, as a recording limited to the conclusion phase of the contract is sufficient. For
the recordings of calls made between fortune tellers and customers, and between fortune tellers
and switchboard operators, no contract being concluded during these calls, they are not necessary
for the achievement of this purpose.
70. Secondly, the company argues that, insofar as the entire service takes place orally, the full and
systematic recording of the aforementioned conversations is necessary for the defence of its legal
rights in order to prove the proper performance of the contract, particularly when it is faced with
claims for reimbursement.
11
71. The Restricted Committee wishes to recall that, while the retention of certain data collected for
specific and legitimate purposes may be justified for litigation or pre-litigation purposes, such an
objective cannot justify as such the recording of all telephone calls, in their entirety.
72. The Restricted Committee further notes that, in the case in point, the company is likely to have
other elements enabling it to ensure its defence (such as, for example, text messages confirming
appointments and invoicing). In any event, it notes that the justification provided by the company
does not appear consistent since, as it stands, 50% of the recordings being deleted each evening, it
does not appear able to provide these recordings systematically in the context of the legal
proceedings that may be initiated against it.
73. With regard to the full and systematic recording of telephone calls with a view to judicial
requisitions, the Restricted Committee recalls that, while it is necessary for controllers to grant the
judicial requisitions they receive concerning the data they process for their own purposes, they do
not, however, have to organise, in advance, the collection of personal data with a view to
responding to a potential judicial requisition (CNIL, FR, 8 June 2023, Sanction, SAN-2023-008,
published). Thus the company cannot validly argue that it would be exposed to any criminal
sanction in the event that it was unable to respond to the requisitions received, due to the fact that
it did not have this data.
74. With regard to the full and systematic recording of telephone calls for the purpose of safeguarding
human life, the Restricted Committee noted that, in the case in point, the fortune tellers or
switchboard operators may have to contact the emergency services in response to violent or
suicidal comments made by customers.
75. The Restricted Committee considers that it cannot be validly argued that such cases would justify
the full and systematic recording of conversations, particularly in view of the low proportion of
these calls compared to the number of consultations carried out (89 calls in 2021 for approximately
360,000 consultations), on the understanding that assistance to persons in danger does not fall
within the scope of the declared and daily activities of the company. It also emphasises that, on
the one hand, it is the reaction of the participants (fortune tellers or switchboard operators) to the
messages of certain customers, and not the existence of the recordings in question, that enables the
emergency services to intervene and, on the other hand, that a mechanism enabling the company’s
employees to manually trigger the recording when they are confronted with worrying messages
could perfectly well be put in place (a manual interruption mechanism already existing with regard
to the recording of customers’ bank details).
76. Therefore, the company cannot argue that the full and systematic recording of calls would be
necessary for the purposes of safeguarding human life.
77. In view of all these elements, the Restricted Committee considers that a breach of Article
5(1)(c) GDPR is constituted.
12
2) On the failure to comply with the obligation to define and respect a retention period
proportionate to the purpose of the processing pursuant to Article 5(1)(e) GDPR
78. Pursuant to Article 5(1)(e) GDPR, personal data must be “kept in a form which permits
identification of data subjects for no longer than is necessary for the purposes for which the
personal data are processed (…)”.
79. In accordance with these provisions, it is the responsibility of the controller to define a retention
period that is consistent with the purpose of the processing. Once this purpose has been fulfilled,
the data must be deleted or rendered anonymous, or be archived for a specific period of time when
its retention is necessary, e.g. to comply with legal obligations or for pre-litigation or litigation
purposes.
80. By way of illustration, Deliberation No 2021-131 of 23 September 2021 adopting a reference
framework relating to processing implemented for the purposes of managing commercial activities
states that customer data may be retained at the end of the commercial relationship under certain
conditions, and points out that the retention periods must be set according to each purpose. While
said reference framework proposes retention periods, it provides that an organisation may choose
to deviate from it in view of the specific conditions relating to its situation and to retain the data
for a longer period, provided this period does not exceed that necessary for the purposes for which
it is processed and provided it is able to justify it.
81. With regard to the retention of customer data for the purposes of commercial prospecting, the
aforementioned guidelines recommend a maximum period of three years from the end of the
commercial relationship.
82. The Rapporteur considers that the six-year period set by the company for storing its customers’
data from the end of the last service carried out on their behalf, for the purposes of commercial
canvassing, appears excessive. It emphasises that it emerges from the information provided by
the company, and in particular from its own internal guidelines on retention periods (which men-
tions the legally prescribed periods as well as those recommended by the CNIL), that it was fully
aware of the recommended periods and that it chose to deviate from them. It also notes that the
information accessible from the website states that the data is kept for the
duration of the business relationship and for a maximum of five years after the last contact with
the company, which does not correspond to the practice observed during the inspection. Further-
more, the Rapporteur considers that this six-year period must be put into perspective with the
very high number of canvassing messages sent by the company, as well as with the number of
requests to exercise the right to object or the right to erasure received by the company, which tes-
tifies to the discomfort that can result from such practices.
83. In its defence, the company stresses that the retention periods recommended by the CNIL are not
mandatory and that an organisation may choose to deviate from them.
13
84. It argues that the six-year period is adapted to the specifics of the market, and produces a study
carried out by it revealing that some of its inactive customers would once again consume a service
with the company while their last consumption was more than three years old. It estimates the
revenue generated by these customers at more than €1.1m for 2022. It points out that, given the
nature of the consultations provided, it seems reassuring for customers that their data is kept, in
order to allow them personalised access. The company also puts into perspective the number of
requests to exercise the right to object or the right to erasure that it receives in relation to the total
number of contacts with its customers and prospects. In addition, it notes that the retention period
implemented appears to be totally in line with the civil (five years) and criminal (six years)
limitation periods. In any event, it considers that it has not committed any breach, insofar as it has
put in place a clear policy of data retention periods, which it applies and with which it complies.
85. The Restricted Committee noted that, in the case in point, the company kept its customers’ data
for a period of six years from the end of the last service carried out on their behalf, in particular
for the purposes of commercial canvassing.
86. Firstly, the Restricted Committee notes that the breach alleged against the company relates
exclusively to the period of retention of its customers’ data for commercial prospecting purposes,
and not to the period implemented for other purposes. It recalls in particular that, where personal
data is no longer used to achieve the objective that justified the collection of the data (e.g. when
the business relationship has ended) but still presents an administrative interest for the organisation
(e.g. for the management of any litigation) or has to be retained to meet a legal obligation, such
data may be retained by intermediate archiving, enabling it to be consulted by specifically
authorised persons (CNIL, FR, 28 May 2019, Sanction, SAN-2019-005, published; CNIL, FR, 29
October 2021, Sanction, SAN-2021-019, published; CNIL, FR, 7 July 2022, Sanction, SAN-2022-
015, published; CNIL, FR, 29 December 2023, Sanction, SAN-2023-023, published).
87. Secondly, the Restricted Committee considers that the six-year period implemented by the
company does not appear proportionate with regard to the purpose relating to commercial
prospecting. The Restricted Committee notes that the information produced by the company does
not justify the duration used, which leads to keeping the data twice as long as the duration
recommended by the CNIL in its management of commercial activities guidelines.
88. With regard to the study produced by the company, the Restricted Committee notes first of all that
it reveals that the majority of customers covered by this study returned to consult after a period of
inactivity of three years or less (63%). It then observes that the study in question only targets
customers who returned to consult after a period of inactivity of between one year and six years,
but does not include those who did not return to consult, nor those who returned to consult after a
period of inactivity of less than one year. Thus, as the Rapporteur pointed out, the 37% mentioned
does not correspond to 37% of the company’s customers, as the latter asserts, or even to the total
of inactive customers (whether or not they returned to consult), the proportion of the number of
customers who returned to consult after a period of inactivity of between three and six years,
compared to the total number of customers of the company, being necessarily lower.
14
89. The Restricted Committee also wishes to point out that the periods recommended by the CNIL in
its guidelines are defined, in particular, with regard to the inconvenience likely to be caused by the
repeated sending of commercial prospecting messages. In this respect, the Restricted Committee
sanctioned an organisation that kept the data of its inactive customers for a period of four years for
commercial prospecting purposes, pointing out that the recommended period of three years was
already substantial (CNIL, FR, 18 November 2020, Sanction, SAN-2020-008, published). In the
case in point, the Restricted Committee considers that the mass sending of commercial prospecting
messages by the company – which has indicated having sent on average nearly one emails per day
to its inactive customers over the first three quarters of 2021 (i.e. nearly 30 million emails to
approximately 112,000 people) – justifies limiting the data retention period to three years, this
period and the regularity of the requests from the company very largely leaving the opportunity
for the data subjects to come forward if they wished to use the services of the company again.
90. Consequently, the Restricted Committee notes that the fact that the company retains its
customers’ data for a period of six years for commercial prospecting purposes constitutes a
breach of the provisions of Article 5(1)(e) GDPR.
3) On the failure to comply with the obligation to obtain the prior consent of data subjects to
the collection of particular categories of data pursuant to Article 9 GDPR
91. Under Article 9(1) GDPR, “[p]rocessing of personal data revealing racial or ethnic origin, political
opinions, religious or philosophical beliefs, or trade union membership, and the processing of
genetic data, biometric data for the purpose of uniquely identifying a natural person, data
concerning health or data concerning a natural person’s sex life or sexual orientation shall be
prohibited”, unless such processing falls within one of the conditions set out in paragraphs 2(a) to
(j) of the same article.
92. Among these conditions, it is provided in particular that the processing may take place “the data
subject has given explicit consent to the processing of those personal data for one or more specified
purposes, except where Union or Member State law provide that the prohibition referred to in
paragraph 1 may not be lifted by the data subject” (Article 9(2)(a)).
93. The Rapporteur observes that the company does not obtain the prior and explicit consent of its
customers or prospects for the collection of sensitive data. She refers, on the one hand, to data
relating to the sexual orientation of users of the , collected through
a form intended to provide a prediction of their love compatibility and, on the other hand, to
sensitive data collected by the fortune tellers during telephone consultations (sex life, health,
religious beliefs, etc.).
94. In its defence, with regard to the data collected through the form on the
website, the company considers that the data in question cannot be categorised as sensitive data
and that processing both the civil status and the date of birth of a person is common practice in
many areas.
15
95. With regard to data collected as part of telephone consultations, the company states that it does
not process sensitive data, and in particular does not voluntarily collect such data. In particular, it
argues that fortune tellers do not raise any questions relating to this type of data, and states that it
has put in place procedures so that such data that could be spontaneously provided by customers
is not mentioned in any computer or paper file. It further points out that its general conditions
prohibit the disclosure of sensitive information and that customers who disclose such data would
be in breach of these conditions. It adds that it makes no use of this data and does not provide any
service on this basis.
96. Finally, the company considers that in any event, in the event that it is considered that special
categories of data are processed by the company, the exception based on Article 9(2)(e) GDPR
should then apply, with regard to information manifestly made public by data subjects.
97. Firstly, the Restricted Committee notes that the company does indeed process special categories
of data (termed sensitive data), within the meaning of Article 9 GDPR.
98. On the one hand, it notes that it emerges from the online inspection carried out on 15 November
2021 from the website that after creating a user account (requiring
entering, at least, an email address, first name, last name, sex and date of birth), the delegation
was able to access a form intended to provide users of the website with a free prediction of their
love compatibility with a person of their choosing. The user’s first name, date of birth and sex
must thus be entered on the form, as well as the first name, date of birth and sex of his/her partner.
99. The Restricted Committee notes first of all that this information, in that it relates to an identified
or identifiable natural person – in particular thanks to the provision of the full identity of the user
and his/her email address when registering on the website, it being recalled that the findings were
made while the delegation was connected to his/her user account – constitutes "personal data"
within the meaning of Article 4(1) GDPR.
100. The Restricted Committee then recalls that, in a judgment of 1 August 2022, the Court of Justice
of the European Union (hereinafter “the CJEU”) considered that, even if the data in question did
not constitute, by nature, sensitive data, it had to be considered as such when it was likely to
indirectly disclose the sexual orientation of the data subject (CJEU, Grand Chamber, 1 August
2022, Vyriausioji tarnybinės etikos komisija, No C184-20).
101. In the case in point, the fact that the company collects both the sex of the data subject and that of
his/her partner, in a context of love compatibility, makes it possible to infer the sexual orientation
of this person. Therefore, the data collected must be classified as sensitive data, within the meaning
of Article 9 GDPR.
102. On the other hand, the Restricted Committee notes that it emerges from the recordings sent to the
inspection delegation that, during telephone consultations, customers may communicate to the
fortune tellers certain sensitive data, such as data revealing their religious beliefs, data concerning
their health or even their sex life or sexual orientation. Even if the company indicates that it does
not use this data for a specific purpose, it appears that it is indeed processed, insofar as it is
collected (via the recording of telephone conversations), retained (for a more or less long period,
16
with half of the recordings being deleted at the end of the day, the other half being kept for six
months), liable to be consulted (e.g. in the event of a dispute) and ultimately deleted. Various
processing operations referred to in Article 4(2) GDPR are thus carried out in connection with this
data.
103. Secondly, the Restricted Committee considers that the processing of sensitive data collected
during fortune telling consultations can only take place on the basis of the explicit consent of the
data subjects to the processing of their personal data for one or more specific purposes, pursuant
to Article 9(2)(a) GDPR, since none of the other conditions set forth under Article 9(2)(b) to (j)
GDPR can be mobilised in the case in point (CNIL, FR, Sanction, 8 June 2023, SAN-2023-008,
published).
104. Indeed, contrary to what the defendant company indicates, the Restricted Committee notes that it
cannot argue that the processing carried out would relate to “personal data which are manifestly
made public by the data subject” (Article 9(2)(e) GDPR). With regard to this exception, the
guidelines 8/2020 on the targeting of social media users adopted on 13 April 2021 by the European
Data Protection Board (hereinafter “the EDPB”) recall that it implies that “controllers can
demonstrate that the data subject has clearly expressed his/her intention to make [such data]
public”, which is not the case for a private conversation between a fortune teller and a customer.
105. With regard to the consent required pursuant to Article 9(2)(a) GDPR, the Restricted Committee
recalls that the explicit nature of the consent is analysed on a case-by-case basis and depends on
the context of the processing of sensitive data. When the service requested by the user necessarily
involves the processing of sensitive data, it is, however, necessary for the user to be fully aware
that his/her sensitive data will be processed and sometimes stored by the controller, which in
principle implies explicit information on this point when obtaining consent.
106. The Restricted Committee points out that, according to Article 4(11) GDPR, the concept of consent
is understood to mean any freely given, specific, informed and unequivocal expression of will by
which the data subject signifies his/her agreement, by a declaration or by a clear positive act, to
personal data concerning him/her being processed.
107. On the one hand, the Restricted Committee considers that the explicit nature of the consent set
forth in Article 9(2)(a) GDPR presupposes that the data subject is able to demonstrate, through a
positive action, his/her assent to the processing of sensitive data, attesting to the materiality of
hi/hers consent.
108. By way of clarification, the Restricted Committee recalls that in its guidelines on consent within
the meaning of Regulation 2016/679 of 10 April 2018, the EDPB states that “GDPR stipulates that
a ‘clear positive statement or act’ is a sine qua non of a ‘standard’ consent. Since the requirements
for ‘standard’ consent in GDPR are already raised to a higher level than those of Directive
95/46/EC, it should be specified what additional efforts a controller should undertake in order to
obtain the explicit consent of a data subject in accordance with GDPR. The explicit term refers to
how consent is expressed by the data subject. It implies that the data subject must make a
declaration of express consent. An obvious way to ensure that consent is explicit would be to
17
expressly confirm consent in a written statement. Where appropriate, the controller could ensure
that the written statement is signed by the data subject in order to prevent potential doubt and
potential absence of evidence in the future. However, such a signed statement is not the only way
to obtain explicit consent […]” (Guidelines 2016/679 WP259 rev.01 of 10 April 2018, page 21).
109. The Restricted Committee stresses that on several occasions it has adopted corrective measures
against controllers who do not obtain the explicit consent of individuals to collect and process their
“sensitive” data, in particular in its Deliberations No 2016-405 of 15 December 2016 and No 2016-
406 of 15 December 2016, as well as in its Deliberation No SAN-2017-006 of 27 April 2017, in
which it considered that “the spontaneous provision of such data does not relieve the company of
the obligation to obtain the express consent of individuals, who must be able to demonstrate by
positive action their assent to the processing of sensitive data, thus attesting that the consent is
given with full knowledge of the facts”.
110. The Restricted Committee therefore noted, as it had already done recently with regard to another
organisation providing fortune telling services, that the mere willingness to receive this type of
service and the fact of spontaneously providing sensitive information did not constitute explicit
consent by the data subjects to the processing of their data, and that the controller had to provide
the individuals from whom it collected special categories of data with a means of ensuring that
they gave their explicit consent in a clear positive act (CNIL, FR, 8 June 2023, Sanction, SAN-
2023-008, published).
111. On the other hand, the Restricted Committee points out that the consent obtained under Article
9(2)(a) GDPR had to be read in light of the definition set out in Article 4(11) GDPR, which implied
that, in order to give valid consent, the data subject had first to be fully informed of the specific
nature of the data he/she was communicating, particularly in that it might reveal his/her state of
health and sexual orientation, and of the use that would be made of this data.
112. In the case in point, the Restricted Committee notes that the company does not provide any specific
information to the data subjects regarding the collection and processing of data collected from the
form on the website and does not obtain their explicit consent for the
processing of this data.
113. Similarly, in the context of telephone consultations, neither the switchboard operators nor the
fortune tellers provide information relating to the processing of such data, nor do they obtain
consent.
114. Therefore, the Restricted Committee considers that the company does not provide data subjects
with specific information and does not obtain their explicit consent, so that it cannot avail itself of
the exception to the prohibition on collecting and processing special categories of data set forth in
Article 9(2)(a) GDPR.
115. Consequently, the Restricted Committee considers that in the absence of prior and explicit
consent from customers to the collection of their sensitive data, and of specific information
on this subject, there has been a breach of Article 9 GDPR.
18
4) On the breach of the obligation to obtain the consent of the data subjects for the
implementation of commercial prospecting by electronic means pursuant to Article L34-5
CPCE – NOT SUBJECT TO COOPERATION
116. Under the terms of Article L34-5 CPCE, “direct canvassing by means of an automated electronic
communications system […], a fax machine or electronic mail using the contact details of a natural
person […] who has not previously expressed his/her consent to receive direct canvassing by this
means is prohibited. For the purposes of this article, consent shall mean any free, specific and
informed expression of will by which a person accepts that personal data concerning him/her may
be used for the purposes of direct marketing […].”
117. Under Article 4(11) GDPR, “consent” of the data subject means “any freely given, specific,
informed and unambiguous indication of the data subject’s wishes by which he or she, by a
statement or by a clear affirmative action, signifies agreement to the processing of personal data
relating to him or her”.
118. Pursuant to the combined provisions of Articles L34-5 CPCE and 4(11) GDPR, the organisation
that carries out commercial canvassing by electronic means must have the free, specific, informed
and unambiguous consent of the data subjects.
119. The Rapporteur notes that the company indicated that it carried out commercial prospecting
operations by electronic means for prospects whose data had been collected by its partner,
. She considers that does not have the informed consent of the data
subjects to carry out these operations. It considers that, when collects this data through
a form on its website, no list of partners to whom the data may be transmitted is easily
accessible and, therefore, the data subjects cannot expect to receive marketing messages from
since they have not validly consented to it.
120. In its defence, the company considers, firstly, that the joint liability agreement signed with
enables the two companies to send emails and text messages indifferently to the
customers and prospects of both companies.
121. Secondly, the company argues that a list of partners was indeed accessible from the form in
question, and that no breach could therefore be upheld.
122. Thirdly, the company indicates that, since the inspections carried out, the form in question has
changed and that the list of partners likely to send prospecting emails to the data subjects is now
presented in accordance with the recommendations of the Rapporteur.
123. Fourthly and finally, the company considers that in any event, it appears “almost impossible” to
present users with a list of partners, let alone an up-to-date list. According to the company, the fact
of showing such a list clearly constitutes an infringement of business secrecy and is in
contradiction with the contractual clauses (particularly confidentiality clauses) binding it to its
partners.
19
124. The Restricted Committee points out that when the data of prospective customers has not been
collected directly from them by the organisation canvassing, consent may have been obtained at
the time of the initial collection of the data by the initial collector, on behalf of the organisation
that will carry out the subsequent canvassing operations. Otherwise, it is up to the prospecting
organisation to obtain such consent before carrying out any prospecting (CNIL, FR, 24 November
2022, Sanction, SAN-2022-021, published; CNIL, FR, 4 April 2024, Sanction, SAN-2024-004,
published).
125. In addition, for consent to be informed, individuals must in particular be clearly informed of the
identity of the prospector on whose behalf the consent is being collected and the purposes for
which the data is to be used. To this end, an exhaustive and updated list of partners must be made
available to individuals at the time their consent is obtained, e.g. directly on the collection medium
or, if the list is too long, via a hypertext link to said updated list and the privacy policies of service
providers and suppliers (CNIL, FR, 24 November 2022, Sanction, SAN-2022-021, published;
CNIL, FR, 12 October 2023, Sanction, SAN-2023-015, published).
126. In the case in point, the investigation showed that and set up a joint
database (“ ”) containing all the personal data of their
customers and prospects, representing, as at 6 October 2022, more than 7 million contact records
for more than 1.5 million unique individuals (the same customer or prospect may have several
records, depending on how he/she is contacted). These two companies both confirmed that they
process this data, in particular for commercial prospecting purposes, independently of the company
that collected the data. During the first three quarters of 2022, stated that it had sent
85,452 text messages and 7,364,453 emails to just under 54,000 individuals (i.e. one email every
two days) whose contact details had been collected by as part of its fortune telling
services or on its websites.
127. The Restricted Committee also notes that, for the sending of emails and text messages to the
individuals whose data was collected by , indicated that it did not obtain
the prior consent of the data subjects, considering that this collection had already been carried out
on its behalf when the data was collected by .
128. Firstly, with regard to the joint liability agreement existing between and ,
and which the company invokes in this context, the Restricted Committee recalls that, despite the
status of joint managers contractually defined by the two companies for the management of their
common database containing the data of their customers and prospects, each company is
responsible for the operations carried out on its own behalf from this database, in particular
commercial prospecting operations (CNIL, FR, 28 December 2021, Sanction, SAN-2021-021,
published).
129. Therefore, the existence of such an agreement does not exempt the signatory companies from the
need to have the free, specific, informed and unambiguous consent of the data subjects for the use
of their data for the purposes of commercial prospecting by electronic means, when such data has
not been collected directly by the prospecting body.
20
135. An online inspection carried out on 23 April 2024 found that the checkbox used to obtain consent
was accompanied by the text “I give my express consent(3) to receive fortune telling offers by
telephone, email, text message or WhatsApp”. Firstly, the Restricted Committee noted that
although the list of partners now appeared on the same page as the form, only a figure next to the
word “express”, mentioned in the form of a superscript, in very small and illegible characters,
referred to a footnote, located at a distance from the form (and on a part of the page that was not
visible when the form was displayed), in which said list appeared. The Restricted Committee
considers that, given these elements, the user could easily not see this figure, not pay attention to
it or not dwell on it and, therefore, not refer to the content of the note.
136. On the other hand, the Restricted Committee notes that, in this second wording accompanying the
box to be ticked, no further reference to the concept of “partners”, the mere mention “I give my
express consent to receive fortune telling offers by telephone, email, text message or WhatsApp”
suggesting to the user that these offers come exclusively from .
137. It therefore appears that, for these two forms, the consent obtained by did not appear
sufficiently informed to enable to avail itself of such consent in the context of its
commercial prospecting operations by electronic means.
138. Under these conditions, the Restricted Committee considers that, in the absence of informed
consent from the individuals whose data was collected by , is in
breach of Article L34-5 CPCE.
139. The Restricted Committee nevertheless notes that, since the last inspections carried out, it appears
that has again modified the form in question. It emerges from the latest information
provided that the text accompanying the checkbox enabling users’ consent to the use of their data
for commercial prospecting purposes now explicitly targets (“I give my express
consent to receive fortune telling offers by telephone, email, text message or WhatsApp by
and its partners , , and ”). While the
Restricted Committee takes note of this compliance, the breach nevertheless appears to be
constituted for the past.
III. ON THE PRONOUNCEMENT OF CORRECTIVE MEASURES AND THEIR
PUBLICITY
140. Under the terms of Article 20 of Act No 78-17 of 6 January 1978 as amended, “where the controller
or its processor fails to comply with the obligations arising from Regulation (EU) 2016/679 of 27
April 2016 or from this Act, the President of the CNIL may […] refer the matter to the
Commission’s Restricted Committee with a view to ordering, after an adversarial procedure, one
or more of the following measures: [7° With the exception of cases where the processing is
implemented by the state, an administrative fine not exceeding €10m or, in the case of a company,
2% of the total annual worldwide revenue for the previous period, whichever is greater. In the
22
cases referred to in Article 83(5) and (6) of Regulation (EU) 2016/679 of 27 April 2016, these
ceilings are increased to €20 million and 4% of said revenue respectively. In determining the
amount of the fine, the Restricted Committee will take into account the criteria specified in Article
83.”
141. Article 83 GDPR further states that “[e]ach supervisory authority shall ensure that the imposition
of administrative fines pursuant to this Article in respect of infringements of this Regulation
referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and
dissuasive”, before specifying the elements to be taken into account in deciding whether an
administrative fine should be imposed and in deciding the amount of this fine.
142. First of all, the company maintains that it was in no way negligent, as the shortcomings identified
resulted, in its view, from a different application and interpretation of the texts. It considers that,
in any event, the proposed sanction is disproportionate with regard to other decisions handed down
by the Restricted Committee. It thus considers that certain criteria should be taken into account
such as its economic situation, its level of compliance, the length of the procedure, the absence of
prior formal notice and its total cooperation. Lastly, it considers that the proposed publicity
measure is unjustified, insofar as no serious breach has been identified, no complaint has been
lodged and, if it is a question of setting a precedent in the fortune telling sector, the CNIL had
already handed down a decision on 8 June 2023.
143. Firstly, the Restricted Committee recalls that, while the imposition of an administrative fine is
conditional on the establishment of a wrongful breach by the prosecuted body, this fault may result
from deliberate behaviour but also from negligence, pursuant to Article 83(2)(b) GDPR (CJEU,
Grand Chamber, 5 December 2023, Deutsche Wohnen SE et al., C-807/21; CJEU, Grand
Chamber, 5 December 2023, Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos
ministerijos et al., C-683/21).
144. The Restricted Committee considers that, in the case in point, the breaches committed by the
company reveal a certain negligence on its part. Indeed, the Restricted Committee emphasises, on
the one hand, that the rules recalled in this deliberation are subject to constant interpretation by the
CNIL. For example, while the guidelines relating to the processing of personal data implemented
for the purposes of managing commercial activities were published shortly after the inspection
operations, the recommendations it contains do not appear new, since the CNIL has already
adopted, since 2005, simplified standard NS-048 (containing in particular recommendations on
the retention period of customer data for prospecting purposes) and, since 2014, simplified
standard NS-057 (concerning recordings of telephone conversations). On the other hand, the
Restricted Committee notes that the multiplicity of breaches noted shows negligence in the
implementation of the processing carried out by the company.
145. Secondly, the Restricted Committee considers that the criterion set forth in Article 83(2)(a) GDPR
relating to the nature, severity and duration of the breach should be applied, taking into account
the nature and scope of the processing and the number of data subjects.
23
146. The Restricted Committee notes first of all that the breaches of Articles 5(1)(c), 5(1)(e) and 9
GDPR concern the fundamental principles of data protection and are thus likely to be subject to a
fine of up to €20m or 4% of the company's annual revenue of the previous period – i.e. the
maximum amount set forth by the texts –, pursuant to Article 83(5) GDPR. In this respect, the
guidelines on the calculation of administrative fines adopted by the European Data Protection
Board recall that “through this distinction, the legislator gave an initial indication of the seriousness
of the breach, in an abstract manner. The more serious the breach, the higher the fine is likely to
be” (point 50).
147. The Restricted Committee then notes that the breaches identified are likely to concern a large
number of people, with the database common to and comprising more
than 1.5 million unique contacts having the status of prospect or customer. In particular, with
regard to the breach of Article L34-5 CPCE, the Restricted Committee wishes to emphasise that
makes extensive use of sending commercial prospecting messages since it has
indicated that, during the first three quarters of 2022, it sent more than 85,000 text messages and
more than 7.3 million emails to nearly 54,000 people (i.e. one email every two days), whose
contact details were collected by .
148. Furthermore, the Restricted Committee notes that some of the breaches in question have the effect
of depriving the processing carried out of lawfulness. The same applies to the failure to comply
with Article 9 GDPR, as the collection of “sensitive” data is prohibited as a matter of principle,
and to the failure to comply with Article L34-5 CPCE, as commercial canvassing operations are
only lawful if the controller has valid consent.
149. The Restricted Committee also emphasises that individuals using the remote fortune telling
services offered by the company are likely to find themselves in a situation of vulnerability, which
may lead them to lower their vigilance threshold and to easily communicate certain data
concerning them, in particular sensitive data. In these circumstances, compliance with the
requirements relating to the collection of consent is essential.
150. Finally, the Restricted Committee wishes to insist on the potentially very intrusive nature of some
of the processing in question, in particular the full and systematic recording of telephone
conversations (both with regard to the company’s employees and its customers) and the sending
of commercial prospecting messages, the frequency and multiplicity of which are likely to cause
real discomfort for the recipients, for a particularly long period of time.
151. Thirdly, the Restricted Committee wishes to apply the criterion set forth in Article 83(2)(g)
GDPR, relating to the categories of personal data concerned by the breach.
152. In this respect, while the breach of Article 9 GDPR specifically concerns the collection of sensitive
data, the Restricted Committee notes that the breach of Article 5(1)(c) is also likely to relate to
such data, insofar as the recordings made may potentially contain information relating to the sexual
orientation or sex life of the data subjects, their religious beliefs or even their health.
153. Fourthly, the Restricted Committee wishes to take into account the degree of cooperation with
the supervisory authority that the company has demonstrated, pursuant to Article 83(2)(f) GDPR.
24
It would appear that, following receipt of the Rapporteur’s observations in response, the company
has complied with the breach of Article L34-5 CPCE.
154. The Restricted Committee considers that all these elements justify the imposition of an
administrative fine.
155. With regard to the amount of the fine, the Restricted Committee would point out that, pursuant
to Article 83 GDPR, the breaches identified may be subject to an administrative fine of up to €20m
or up to 4% of the worldwide annual revenue for the previous period, whichever is higher.
156. It took the view that the company’s business and financial situation should be taken into account.
It notes in this respect that generated, for the year 2021/2022, revenue of
approximately € , for a profit of more than € . The following year, this revenue came to
€ , with a net loss of € .
157. In view of the company’s liability, its financial capacity and the relevant criteria of Article 83(2)
GDPR referred to above, the Restricted Committee considers that a fine of two hundred and fifty
thousand (250,000) euros appears justified.
158. With regard to the publication of the sanction, the Restricted Committee considers that this is
justified in view of the seriousness of some of the breaches in question, the company’s position on
the market, the scope of the processing operations and the number of data subjects.
159. It also notes that this measure is intended in particular to inform the data subjects by the processing
carried out by the company, whether these are prospects or customers. This provision of
information would enable them to assert their rights if necessary.
160. Lastly, it took the view that this measure was proportionate given that the decision would no longer
identify the company by name two years after publication.
25
CONSEQUENTLY
The Restricted Committee of the CNIL, after deliberation, decides to:
• impose an administrative fine on in the amount of two hundred and fifty
thousand (250,000) euros for breaches of Articles 5(1)(c), 5(1)(e) and 9 of Regulation
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and
L34-5 of the French Postal and Electronic Communications Code, which breaks down
as follows:
➢ two hundred thousand (200,000) euros for breach of Articles 5(1)(c), 5(1)(e)
and 9 of Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016;
➢ fifty thousand (50,000) euros for breach of Article L34-5 of the French Postal
and Electronic Telecommunications Code;
• make public, on the CNIL website and on the Légifrance website, its deliberation,
which would no longer allow the company to be identified by name at the end of a period
of two years from its publication.
The President
Philippe-Pierre Cabourdin
This decision may be appealed before the CE within two months of its notification.
26