Deliberation of the Restricted Committee No SAN-2024-015 of 26 September 2024
concerning
The Commission nationale de l’informatique et des libertés (French Data Protection Authority),
meeting in its Restricted Committee composed of
members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 on the protection of personal data and on the free movement of such data (hereinafter
“GDPR”);
Having regard to the French Postal and Electronic Communications Code;
Having regard to the French Data Protection Act no. 78-17 of 6 January 1978, and in particular
Articles 20 et seq.;
Having regard to Decree No 2019-536 of 29 May 2019 implementing Law No 78-17 of 6 January
1978 on data processing, data files and individual liberties;
Having regard to deliberation no. 2013-175 of 4 July 2013 adopting the internal regulations of the
CNIL (French Data Protection Authority);
Having regard to decision No 2021-270C of 4 October 2021 of the President of the CNIL to
instruct the Secretary General to carry out or have carried out a verification mission of the
processing operations implemented by and or on their behalf, in any place
likely to be concerned by their implementation;
Having regard to the decision of the President of the CNIL of 16 November 2023 appointing a
Rapporteur to the Restricted Committee;
Having regard to the report of , Commissioner-Rapporteur, served on
on 15 March 2024;
Having regard to the written observations submitted by on 12 April 2024;
Having regard to Decision No 2024-092C of 22 April 2024 of the President of the CNIL to instruct
the Secretary General to carry out or have carried out a mission to verify any processing accessible
from the domain " " or relating to personal data collected from the latter;
Having regard to the Rapporteur’s reply to these observations, notified to the company on 30 April
2024;
Having regard to the written observations submitted by on 30 May 2024;
Having regard to the closure of the investigation, notified to the company on 11 June 2024;
1
Having regard to the request for postponement of the meeting made by the company on 18 June
2024, and the response to this request sent by the President of the Restricted Committee to the
company on 20 June 2024;
Having regard to the request for reopening of the investigation made by the company on 26 June
2024, and the response to this request sent by the President of the Restricted Committee to the
company on 27 June 2024;
Having regard to the oral observations made at the Restricted Committee session on 4 July 2024;
Having regard to the other documents in the case file;
The following were present at the Restricted Committee meeting:
- Ms Sophie Lambremon, auditor, whose report was read out;
As representatives of
- Maître
- Maître
having spoken last;
The Restricted Committee implemented the following decision:
I. FACTS AND PROCEEDINGS
1. (hereinafter "the company"), whose registered office is located at
, is a simplified joint stock company whose main activity is the
development and provision of IT and digital services. As at 30 November 2021, it had 43
employees.
2. Between March 2021 and March 2022, it generated revenue of around € m and net income of
€ . The following year, revenue came to approximately € , with net income of € .
3. The main client of the company is , its long-standing partner, their relationship being
governed, on the one hand, by a subcontracting agreement and, on the other, by a joint
responsibility agreement concerning the processing of certain personal data.
4. also operates a number of digital services related to the divinatory arts on its own
behalf. In this respect, it publishes several websites, including the website, offering
in particular fortune telling services by text message, by SVA (service corresponding to a premium
rate telephone number) or by an online text message exchange tool (hereinafter “chat”). In 2021,
an average of 7,401 individual customers per month used the services offered by text message.
This figure amounts to 6,355 for consultations by SVA and 1,175 for chat in French. On some of
2
its websites, the company also offers personalised fortune telling services by telephone, provided
by .
5. In order to promote its offers, carries out commercial prospecting campaigns by email
and text message, both with its customers and with prospective customers whose contact details
have been obtained either directly by (mainly via its websites) or by To
do this, the two companies have set up a common database
), containing the data of all their customers and prospects, which represented, on
6 October 2022, more than 7 million contact sheets for more than 1.5 million unique individuals.
6. The company indicated that it had, over the first three quarters of 2022, sent nearly 4 million text
messages and more than 7.2 million commercial prospecting emails.
7. On 15 November 2021, a delegation of the Commission nationale de l’informatique et des libertés
(hereinafter “the CNIL” or “the Commission”) carried out an online inspection from five websites
published by and Its purpose was to verify compliance with the
provisions of French Data Protection Act No 78-17 of 6 January 1978 (hereinafter the “French
Data Protection Act” or “amended Act of 6 January 1978”) and the other provisions relating to the
protection of personal data set forth by legislative and regulatory texts, European Union law and
France’s international commitments. The report drawn up at the end was notified to on
22 November 2021.
8. An on-site inspection was also carried out on 7 and 8 December 2021 at the premises of the
aforementioned companies. The related reports were notified to on 10 December 2021.
9. The company provided the delegation with additional information on 20 December 2021, 26
January, 25 February, 30 May, 5 August and 13 October 2022.
10. On 16 November 2023, the President of the Commission appointed as
Rapporteur on the basis of Article 22 of the amended Act of 6 January 1978.
11. In accordance with Article 56 of Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of personal data and on the free movement of such data
(hereinafter “GDPR”) and in view of the elements of the file, the CNIL, on 27 April 2023, informed
all the European supervisory authorities of its competence to act as lead supervisory authority
concerning cross-border processing implemented by the company, resulting from the fact that the
company’s main establishment was located in France. After exchanges between the CNIL and the
European data protection authorities within the framework of the one-stop-shop mechanism, it
appears that the German, Austrian, Belgian, Cypriot, Spanish, Greek, Hungarian, Italian, Latvian,
Luxembourg, Dutch, Portuguese, Czech and Swedish authorities were concerned by the processing
carried out, with individuals residing in these member states having used the chat fortune telling
services offered by the company.
12. On 15 March 2024, at the end of her investigation, the Rapporteur sent the company a report
detailing the breaches of Articles 5(1)(e) and 9(2) GDPR and Article L34-5 of the French Post and
Electronic Communications Code (hereinafter “CPCE”) that she considered to have occurred in
3
the case in point. This report proposed that the Restricted Committee impose an administrative
fine on the company. It also proposed that this decision be made public but that it would no longer
be possible to identify the company by name at the end of a period of two years from its
publication.
13. On 12 April 2024, the company submitted its observations in response to the sanction report.
14. On 23 April 2024, at the request of the Rapporteur and pursuant to Article 39 of the Decree of 29
May 2019, a CNIL delegation carried out a new online inspection from the website
.The report drawn up at the end was notified to on 30 April
2024.
15. On the same day, the Rapporteur responded to the company’s observations of 12 April 2024.
16. On 30 May 2024, the company submitted further observations in response.
17. On 11 June 2024, pursuant to Article 40-III of Decree No 2019-536 of 29 May 2019 implementing
the Data Protection Act (hereinafter “the Decree of 29 May 2019”), the Rapporteur informed the
company and the President of the Restricted Committee that the investigation had been closed.
18. On the same day, the company was informed that the file had been placed on the agenda of the
Restricted Committee session of 4 July 2024.
19. The Rapporteur and the company made verbal observations at the Restricted Committee session.
II. REASONS FOR THE DECISION
A. With regard to the European cooperation procedure
20. The Rapporteur considers that the company implements cross-border processing of personal data
insofar as some of its customers access the services offered from other EU countries. She thus
notes that the company sent the delegation a document stating the number of people who use its
chat fortune telling service each month in French, with a breakdown of customers by country,
which attests to the cross-border nature of the processing.
21. In its defence, the company considers that the CNIL wrongly informed its European counterparts
of the procedure followed against it and that the application of the cooperation mechanism was not
appropriate. It indicates first of all that consultations by chat are exclusively delivered in French.
Then, while it admits that it may happen, “exceptionally and marginally”, that some French
customers access this service from abroad, it considers that they are not themselves foreign, based
on the place of birth of the data subjects. The company considers that, in view of these elements,
only the Belgian authority could possibly be concerned.
22. The Restricted Committee notes that it emerges from the evidence in the case file that each
month, during 2022, several dozen people used the chat fortune telling service offered by the
company from different EU countries. This circumstance is sufficient to establish the existence of
4
cross-border processing, insofar as it affects or is likely to significantly affect data subjects in
several member states, within the meaning of Article 4(23)(b) GDPR, notwithstanding the
language in which these individuals express themselves, their nationality or even their place of
birth.
23. Pursuant to Article 60(3) GDPR, the draft decision adopted by the Restricted Committee was
forwarded to the other competent European supervisory authorities, with a view to enabling them
to make relevant and reasoned objections to the processing operations and breaches which concern
them, on 22 August 2024.
24. As of 19 September 2024, none of the supervisory authorities concerned had raised any relevant,
reasoned objection to this draft decision so that, pursuant to Article 60(6) of the GDPR, they are
deemed to have approved it.
B. On the procedure followed before the Restricted Committee
1) On the objection based on the lack of knowledge of the right to a fair trial
25. The company disputes the manner in which the proceedings before the CNIL were conducted,
considering in substance that the Rapporteur did not demonstrate that the alleged breaches were
established and that its right to a fair trial was not respected. In particular, it states that it was not
made aware of the document entitled “IMI REPORT – Number: – Article 56 –
identification of the LSA and CSA”, in which the CNIL informs the supervisory authorities
concerned of the initiation of sanction proceedings, until after the investigation had been
completed, and that it was therefore not given the opportunity to present its observations on this
point.
26. Furthermore, the company considers that the refusal to its request to postpone the meeting of 4
July 2024 is unjustified.
27. The Restricted Committee notes, firstly, that in order to prepare her report, the Rapporteur relied
on the information gathered during inspections, carried out in compliance with the provisions of
the French Data Protection Act, and that she examined the facts observed in light of the applicable
rules on the protection of personal data. The Restricted Committee thus considers that no element
is likely to reveal an unfavourable bias of the Rapporteur towards the company.
28. Secondly, the Restricted Committee recalls that the adversarial principle implies the right for the
parties to be notified of and to be able to discuss any exhibits or observations submitted to the
judge with a view to influencing his decision (ECHR, Grand Chamber, 20 February 1996,
Vermeulen v. Belgium, No 19075/91).
29. The Restricted Committee recalls, on the one hand, that pursuant to Article 40-III of Decree No
2019-536 of 29 May 2019, the decision to close the procedure belongs to the Rapporteur, when
she considers the case as is. In the case in point, it should be noted that the Rapporteur took this
decision on 10 June 2024, considering that the debate was exhausted after several exchanges of
5
submissions with the company, the latter having made its observations last. These exchanges
included the documents on which the Rapporteur has based her characterisation of the breaches
that she is proposing to the Restricted Committee.
30. The Restricted Committee also notes that the document entitled “IMI REPORT – Number:
– Article 56 – Identification of the LSA and the CSA”, which is merely an informative
document in the context of the procedure for cooperation between supervisory authorities, is one
of the documents in the procedural file. It notes that the company was informed of the possibility
of reading and copying all the exhibits of said file when the sanction report was served on 15
March 2024. However, the Restricted Committee notes that the company did not ask to consult
said file and that it was only on 21 June 2024, i.e. 10 days after the closure of the proceedings, that
the company requested communication of this document, which was sent to it in response to its
request on 24 June 2024.
31. In any event, the Restricted Committee notes that the company was able to present its oral
observations on the aforementioned document at the meeting of 4 July 2024. The Restricted
Committee also recalls that the entire file of the procedure was also made available to it before the
session. It follows from the foregoing that the members of the Restricted Committee were able to
have all the elements enabling them to make their decision.
32. Under these conditions, the Restricted Committee considers that the adversarial principle has not
been disregarded. With regard more generally to the conduct of the proceedings, the Restricted
Committee notes that it was conducted on a regular basis, the company having been able to present
its observations, first in writing within the framework of the investigation, then orally during the
Restricted Committee session of 4 July 2024, in accordance with the procedural rules set out in
Articles 22 of the French Data Protection Act, 39 to 45 of the Decree of 29 May 2019 and 61 to
70-1 of the CNIL internal regulations.
33. Thirdly and finally, with regard to the refusal of the request made by the company on 18 June 2024
that the meeting of 4 July 2024 be postponed due to the unavailability of its Counsel, the Restricted
Committee observes that such a decision rests with the President of the Restricted Committee who,
in the case in point, considered in particular that the company had twice presented its observations
in response to the report and response of the Rapporteur and also had had sufficient time to
organise itself, as he indicated in his response of 20 June 2024. The Restricted Committee notes
in this respect that the company was represented at the meeting of 4 July 2024, with the appointed
Counsel having been substituted by one of his Colleagues. Consequently, in view of all the
6
foregoing, the company is not entitled to argue that the proceedings against it disregarded its right
to a fair trial
2) On the online inspection of 23 April 2024
34. The company considers that the documents relating to the online inspection carried out on 23
April 2024 from the website must be excluded from the proceedings, insofar as this
website does not belong to .
35. The Restricted Committee notes that, by decision No 2021-270C of 4 October 2021, the President
of the CNIL instructed the Secretary General to carry out or have carried out a verification mission
of the processing operations implemented by and .
36. Pursuant to this decision, a CNIL delegation carried out, on 15 November 2021, an online
inspection from several websites published by these two bodies. The findings made revealed that
implemented, on its website , a form enabling it to collect user
data for commercial prospecting purposes.
37. In the context of its exchanges with the supervisory delegation, indicated that it had
set up, with its partner , a common database enabling them to send prospecting emails
and text messages indifferently to the customers and prospects of either of the companies.
38. In her report, notified to on 15 March 2024, the Rapporteur argued that the latter could
not, in order to carry out its prospecting operations, avail itself of the consent obtained by
via the form implemented on its website on the grounds that
no list of partners (mentioning was easily accessible. She considered that this
constituted a breach of Article L34-5 CPCE.
39. In its observations in response of 12 April 2024, responded on this point and indicated
in particular that, since the online inspection of 15 November 2021, the form on the
website had been modified. In this regard, it provided a screenshot of this
new form.
7
40. Within the framework of the powers granted to her by Article 39(4) of the Decree of 29 May 2019,
the Rapporteur requested the carrying out of a new inspection, with the aim of verifying the
compliance of the form mentioned by in its observations in response.
41. By decision No 2024-092C of 22 April 2024, the President of the CNIL instructed the Secretary
General to carry out or have carried out a mission to verify any processing accessible from the
domain “ ” or relating to personal data collected from it.
42. It was under these conditions that a CNIL delegation carried out a new online inspection of this
site, on 23 April 2024.
43. The Restricted Committee notes that the inspection decision of 22 April 2024 does not refer to
or but rather to the domain , from which data
processed by is collected.
44. Under these conditions, there is no need to dismiss the exhibits relating to the online inspection of
23 April 2024.
C. On the breaches noted
1) On the failure to comply with the obligation to define and respect a retention period
proportionate to the purpose of the processing pursuant to Article 5(1)(e) GDPR
45. Pursuant to Article 5(1)(e) GDPR, personal data must be “kept in a form which permits
identification of data subjects for no longer than is necessary for the purposes for which the
personal data are processed (…)”.
46. In accordance with these provisions, it is the responsibility of the controller to define a retention
period that is consistent with the purpose of the processing. Once this purpose has been fulfilled,
the data must be deleted or rendered anonymous, or be archived for a specific period of time when
its retention is necessary, e.g. to comply with legal obligations or for pre-litigation or litigation
purposes.
8
47. In this respect, the Restricted Committee has repeatedly recalled that the retention period for
personal data must be determined according to the purpose of the processing. When it is no longer
necessary for the purpose for which it was collected, the data must either be deleted or be subject
to intermediate archiving when its retention is necessary, e.g. for compliance with legal obligations
or for pre-litigation or litigation purposes. This intermediate archiving first requires sorting the
relevant data to be archived, with regard to the purposes justifying the retention of this data (legal
or accounting obligations, contentious purpose, etc.), then separating it from the active database,
which may be physical – via a transfer of the data within a dedicated archive database – or logical
– via the implementation of technical and organisational measures guaranteeing that only
individuals with an interest in processing the data due to their functions can access it (CNIL, FR,
8 September 2022, Sanction, SAN-2022-018, published; CNIL, FR, 29 December 2023, Sanction,
SAN-2023-023, published).
48. The Rapporteur notes that in the case in point the company retains its customers’ data for a period
of six years from the end of the business relationship, considering that this period corresponds to
the limitation period for criminal offences (the company having stated that it regularly receives
legal requisitions with which it must comply) and arguing the need to retain this data for tax and
accounting reasons, for collection purposes and for the management of disputes. She notes that the
company provided the delegation with information relating to the oldest customer account in its
database (dedicated to chat exchanges), revealing that the data subject had not used any
of the company's services since 6 November 2016, i.e. for more than five years at the time of the
onsite inspection. The Rapporteur considers, on the one hand, that the need to respond to the
judicial requisitions sent to her cannot in itself justify the company organising the retention of data
at the end of the business relationship for this purpose alone. On the other hand, with regard to the
other purposes invoked, the Rapporteur considers that the company should have, at the end of the
business relationship, sorted the data in order to retain only that data strictly necessary for the
pursuit of said purposes – and not all the data processed – and proceeded to intermediate archiving
of this data alone, in order to limit access to it only to individuals with a need to know.
49. In its defence, the company argues that, given the nature of its activities and the strong possibility
that the services provided may be contested, the period of six years is necessary to defend itself
“in the face of a possible civil, consumerist or criminal action”. It also maintains that it would be
subject to a criminal penalty if it were unable to respond to the judicial requisitions it receives.
50. In addition, the company confirms that it retains all data in an active database and does not proceed
with any sorting or intermediate archiving.
51. Firstly, the Restricted Committee points out that, while it is necessary for controllers to comply
with the judicial requisitions they receive concerning the data they process for their own purposes,
they do not have to organise, in advance, the storage of personal data with a view to responding to
a potential judicial requisition. Thus the company cannot validly argue that it would be exposed to
any criminal sanction in the event that it was unable to respond to the requisitions received, due to
the fact that it no longer has the requested data.
9
52. Secondly, the Restricted Committee notes that the data of the company’s customers is collected
for a specific purpose, i.e. management of the business relationship. While, once this purpose has
been reached, the retention of certain data may be justified with regard to other purposes, e.g. the
pre-litigation or litigation purposes invoked by the company, the Restricted Committee considers,
on the other hand, that the company must, at the end of the business relationship, sort the data that
is no longer necessary and retain only that data that needs to be removed for these purposes, by
carrying out their intermediate archiving to limit access to individuals who need to know it due to
their duties. The Restricted Committee notes that the company has confirmed that it does not carry
out any intermediate archiving and keeps all its customers’ data in an active database for a period
of six years from the end of the business relationship, thus not putting in place any differentiated
access depending on the purposes pursued and the data in question. Such a practice does not enable
compliance with the principle of limitation laid down in Article 5(1)(e) GDPR.
53. Thirdly, the Restricted Committee wishes to recall that, while the retention of customer data for
commercial prospecting purposes is possible – if applicable in an active database, after sorting the
data necessary for this purpose –, the duration of this retention must be limited. In this respect,
deliberation No 2021-131 of 23 September 2021 adopting guideines relating to the processing
implemented for the management of commercial activities recommends a maximum period of
three years from the end of the commercial relationship. The Restricted Committee notes that in
the case in point, the company does not provide any evidence to justify the retention of data for a
period of six years.
54. Consequently, the Restricted Committee notes that the fact that the company keeps its
customers’ data in an active database for a period of six years at the end of the business
relationship constitutes a breach of the provisions of Article 5(1)(e) GDPR.
2) On the failure to comply with the obligation to obtain the prior consent of data subjects to
the collection of particular categories of data pursuant to Article 9 GDPR
55. Under Article 9(1) GDPR, “[p]rocessing of personal data revealing racial or ethnic origin, political
opinions, religious or philosophical beliefs, or trade union membership, and the processing of
genetic data, biometric data for the purpose of uniquely identifying a natural person, data
concerning health or data concerning a natural person’s sex life or sexual orientation shall be
prohibited”, unless such processing falls within one of the conditions set out in paragraphs 2(a) to
(j) of the same article.
56. Among these conditions, it is provided in particular that the processing may take place “the data
subject has given explicit consent to the processing of those personal data for one or more specified
purposes, except where Union or Member State law provide that the prohibition referred to in
paragraph 1 may not be lifted by the data subject” (Article 9(2)(a)).
57. The Rapporteur observes that the company does not obtain the prior and explicit consent of its
customers or prospects for the collection of sensitive data. She covers, on the one hand, data
relating to the sexual orientation of users of the collected through a form
10
intended to provide a prediction of their love compatibility and, on the other hand, sensitive data
collected as part of fortune telling consultations by chat or text message (sexual orientation, health
data, etc.).
58. In its defence, with regard to the data collected through the form on the website, the
company considers that the data in question cannot be categorised as sensitive data and that
processing both the civil status and the date of birth of a person is common practice in many areas.
59. With regard to data collected as part of consultations by chat or text message, the company states
that it does not process sensitive data, and in particular does not voluntarily collect such data. In
particular, it argues that fortune tellers do not raise any questions relating to this type of data, and
states that it has put in place procedures so that such data that could be spontaneously provided by
customers is not mentioned in any computer or paper file. It further points out that its general
conditions prohibit the disclosure of sensitive information and that customers who disclose such
data would be in breach of these conditions. It adds that it makes no use of this data and does not
provide any service on this basis.
60. Finally, the company considers that in any event, in the event that it is considered that special
categories of data are processed by the company, the exception based on Article 9(2)(e) GDPR
should then apply, with regard to information manifestly made public by data subjects.
61. Firstly, the Restricted Committee notes that the company does indeed process special categories
of data (termed sensitive data), within the meaning of Article 9 GDPR.
62. On the one hand, it notes that the company invites users of its website to complete a
form intended to provide a free prediction of their love compatibility with a person of their
choosing. The sex, date, time and city of birth, as well as the email address of the user, as well as
the sex and date of birth of his/her partner must be entered.
63. The Restricted Committee notes first of all that this information, in that it relates to an identified
or identifiable natural person – in particular through the provision of the email address, as well as
the date, time and city of birth – constitutes “personal data” within the meaning of Article 4(1)
GDPR.
64. The Restricted Committee then recalls that, in a judgment of 1 August 2022, the Court of Justice
of the European Union (hereinafter “the CJEU”) considered that, even if the data in question did
not constitute, by nature, sensitive data, it had to be considered as such when it was likely to
indirectly disclose the sexual orientation of the data subject (CJEU, Grand Chamber, 1 August
2022, Vyriausioji tarnybinės etikos komisija, No C184-20).
65. In the case in point, the fact that the company collects both the sex of the data subject and that of
his/her partner, in a context of love compatibility, makes it possible to infer the sexual orientation
of this person. Therefore, the data collected must be classified as sensitive data, within the meaning
of Article 9 GDPR.
66. On the other hand, the Restricted Committee notes that it emerges from the records sent to the
inspection delegation that, during consultations by chat or text message, customers may
11
communicate certain sensitive data to the fortune tellers, such as data revealing their sexual
orientation or concerning their health. Even though the company indicates that it does not use this
data for a specific purpose, it appears that it is indeed processed, insofar as it is collected (via the
recording of exchanges by chat or text message), stored, likely to be consulted (e.g. in the event of
a dispute) and ultimately deleted. Various processing operations referred to in Article 4(2) GDPR
are thus carried out in connection with this data.
67. Secondly, the Restricted Committee considers that the processing of sensitive data collected
during fortune telling consultations can only take place on the basis of the explicit consent of the
data subjects to the processing of their personal data for one or more specific purposes, pursuant
to Article 9(2)(a) GDPR, since none of the other conditions set forth under Article 9(2)(b) to (j)
GDPR can be mobilised in the case in point (CNIL, FR, Sanction, 8 June 2023, SAN-2023-008,
published).
68. Indeed, contrary to what the defendant company indicates, the Restricted Committee notes that it
cannot argue that the processing carried out would relate to “personal data which are manifestly
made public by the data subject” (Article 9(2)(e) GDPR). With regard to this exception, the
guidelines 8/2020 on the targeting of social media users adopted on 13 April 2021 by the European
Data Protection Board (hereinafter “the EDPB”) recall that it implies that “controllers can
demonstrate that the data subject has clearly expressed his/her intention to make [such data]
public”, which is not the case for a private conversation between a fortune teller and a customer.
69. With regard to the consent required pursuant to Article 9(2)(a) GDPR, the Restricted Committee
recalls that the explicit nature of the consent is analysed on a case-by-case basis and depends on
the context of the processing of sensitive data. When the service requested by the user necessarily
involves the processing of sensitive data, it is, however, necessary for the user to be fully aware
that his/her sensitive data will be processed and sometimes stored by the controller, which implies
explicit information on this point when obtaining consent.
70. The Restricted Committee points out that, according to Article 4(11) GDPR, the concept of consent
is understood to mean any freely given, specific, informed and unequivocal expression of will by
which the data subject signifies his/her agreement, by a declaration or by a clear positive act, to
personal data concerning him/her being processed.
71. On the one hand, the Restricted Committee considers that the explicit nature of the consent set
forth in Article 9(2)(a) GDPR presupposes that the data subject is able to demonstrate, through a
positive action, his/her assent to the processing of sensitive data, attesting to the materiality of
hi/hers consent.
72. By way of clarification, the Restricted Committee recalls that in its guidelines on consent within
the meaning of Regulation 2016/679 of 10 April 2018, the EDPB states that “GDPR stipulates that
a ‘clear positive statement or act’ is a sine qua non of a ‘standard’ consent. Since the requirements
for ‘standard’ consent in GDPR are already raised to a higher level than those of Directive
95/46/EC, it should be specified what additional efforts a controller should undertake in order to
obtain the explicit consent of a data subject in accordance with GDPR. The explicit term refers to
12
3) On the breach of the obligation to obtain the consent of the data subjects for the
implementation of commercial prospecting by electronic means pursuant to Article L34-5
CPCE – NOT SUBJECT TO COOPERATION
80. Under the terms of Article L34-5 CPCE, “direct canvassing by means of an automated electronic
communications system […], a fax machine or electronic mail using the contact details of a natural
person […] who has not previously expressed his/her consent to receive direct canvassing by this
means is prohibited. For the purposes of this article, consent shall mean any free, specific and
informed expression of will by which a person accepts that personal data concerning him/her may
be used for the purposes of direct marketing […].”
81. Under Article 4(11) GDPR, “consent” of the data subject means “any freely given, specific,
informed and unambiguous indication of the data subject’s wishes by which he or she, by a
statement or by a clear affirmative action, signifies agreement to the processing of personal data
relating to him or her”.
82. Pursuant to the combined provisions of Articles L34-5 CPCE and 4(11) GDPR, the organisation
that carries out commercial canvassing by electronic means must have the free, specific, informed
and unambiguous consent of the data subjects.
83. The Rapporteur notes that the company indicated that it carried out commercial prospecting
operations by electronic means for prospects whose data had been collected by its partner,
She considers that does not have the informed consent of the data
subjects to carry out these operations. It considers that, when collects this data
through a form on its website, no list of partners to whom the data may be
transmitted is easily accessible and, therefore, the data subjects cannot expect to receive marketing
messages from since they have not validly consented to it.
84. In its defence, the company considers, firstly, that the joint liability agreement signed with
enables the two companies to send emails and text messages indifferently to the
customers and prospects of both companies.
85. Secondly, the company argues that a list of partners was indeed accessible from the form in
question, and that no breach could therefore be upheld.
86. Thirdly, the company indicates that, since the inspections carried out, the form in question has
changed and that the list of partners likely to send prospecting emails to the data subjects is now
presented in accordance with the recommendations of the Rapporteur.
87. Fourthly and finally, the company considers that in any event, it appears “almost impossible” to
present users with a list of partners, let alone an up-to-date list. According to the company, the fact
of showing such a list clearly constitutes an infringement of business secrecy and is in
contradiction with the contractual clauses (particularly confidentiality clauses) binding it to its
partners.
14
88. The Restricted Committee points out that when the data of prospective customers has not been
collected directly from them by the organisation canvassing, consent may have been obtained at
the time of the initial collection of the data by the initial collector, on behalf of the organisation
that will carry out the subsequent canvassing operations. Otherwise, it is up to the prospecting
organisation to obtain such consent before carrying out any prospecting (CNIL, FR, 24 November
2022, Sanction, SAN-2022-021, published; CNIL, FR, 4 April 2024, Sanction, SAN-2024-004,
published).
89. In addition, for consent to be informed, individuals must in particular be clearly informed of the
identity of the prospector on whose behalf the consent is being collected and the purposes for
which the data is to be used. To this end, an exhaustive and updated list of partners must be made
available to individuals at the time their consent is obtained, e.g. directly on the collection medium
or, if the list is too long, via a hypertext link to said updated list and the privacy policies of service
providers and suppliers (CNIL, FR, 24 November 2022, Sanction, SAN-2022-021, published;
CNIL, FR, 12 October 2023, Sanction, SAN-2023-015, published).
90. In the case in point, it appears from the investigation that and have set up
a joint database containing all the personal data of their
customers and prospects, representing, as at 6 October 2022, more than 7 million contact records
for 1.5 million unique individuals (the same customer or prospect may have several records,
depending on how he/she is contacted). These two companies both confirmed that they process
this data, in particular for commercial prospecting purposes, independently of the company that
collected the data. During the first three quarters of 2022, reported having sent more
than 2.6 million text messages and more than 1.3 million emails to more than 163,000 individuals
whose contact details had been collected by as part of its fortune telling services or
on its websites.
91. The Restricted Committee also notes that, for the sending of emails and text messages to the
individuals whose data was collected by , indicated that it did not obtain
the prior consent of the data subjects, considering that this collection had already been carried out
on its behalf when the data was collected by
92. Firstly, with regard to the joint liability agreement existing between and ,
and which the company invokes in this context, the Restricted Committee recalls that, despite the
status of joint managers contractually defined by the two companies for the management of their
common database containing the data of their customers and prospects, each company is
responsible for the operations carried out on its own behalf from this database, in particular
commercial prospecting operations (CNIL, FR, 28 December 2021, Sanction, SAN-2021-021,
published).
93. Therefore, the existence of such an agreement does not exempt the signatory companies from the
need to have the free, specific, informed and unambiguous consent of the data subjects for the use
of their data for the purposes of commercial prospecting by electronic means, when such data has
not been collected directly by the prospecting body.
15
although the list of partners now appeared on the same page as the form, only a figure next to the
word “express”, mentioned in the form of a superscript, in very small and illegible characters,
referred to a footnote, located at a distance from the form (and on a part of the page that was not
visible when the form was displayed), in which said list appeared. The Restricted Committee
considers that, given these elements, the user could easily not see this figure, not pay attention to
it or not dwell on it and, therefore, not refer to the content of the note.
100. On the other hand, the Restricted Committee notes that, in this second wording accompanying the
checkbox, there was no longer any reference to the concept of “partners”, the mere mention “I
give my express consent to receive travel offers by telephone, email, text message or ”
suggesting to the user that these offers would come exclusively from .
101. It therefore appears that, for these two forms, the consent obtained by did not appear
sufficiently informed to enable to avail itself of such consent in the context of its
commercial prospecting operations by electronic means.
102. Under these conditions, the Restricted Committee considers that, in the absence of informed
consent from the individuals whose data was collected by , is in
breach of Article L34-5 CPCE. The Restricted Committee nevertheless notes that, since the last
inspections carried out, it appears that has again modified the form in question.It
emerges from the latest information provided that the text accompanying the checkbox enabling
users’ consent to the use of their data for commercial prospecting purposes now explicitly targets
(“I give my express consent to receive fortune telling offers by telephone, email, text
message or by and its partners , and
SBSR Online”).While the Restricted Committee takes note of this compliance, the breach
nevertheless appears to be constituted for the past.
103. The Restricted Committee nevertheless notes that, since the last inspections carried out, it appears
that Cosmopace has again modified the form in question. It emerges from the latest information
provided that the text accompanying the checkbox enabling users’ consent to the use of their data
for commercial prospecting purposes now explicitly targets (“I give my express
consent to receive fortune telling offers by telephone, email, text message or by
and its partners ”). While the
Restricted Committee takes note of this compliance, the breach nevertheless appears to be
constituted for the past.
III. ON THE PRONOUNCEMENT OF CORRECTIVE MEASURES AND THEIR
PUBLICITY
104. Under the terms of Article 20 of Act No 78-17 of 6 January 1978 as amended, “where the controller
or its processor fails to comply with the obligations arising from Regulation (EU) 2016/679 of 27
April 2016 or from this Act, the President of the CNIL may […] refer the matter to the
17
Commission’s Restricted Committee with a view to ordering, after an adversarial procedure, one
or more of the following measures: [7° With the exception of cases where the processing is
implemented by the state, an administrative fine not exceeding €10m or, in the case of a company,
2% of the total annual worldwide revenue for the previous period, whichever is greater. In the
cases referred to in Article 83(5) and (6) of Regulation (EU) 2016/679 of 27 April 2016, these
ceilings are increased to €20 million and 4% of said revenue respectively. In determining the
amount of the fine, the Restricted Committee will take into account the criteria specified in Article
83.”
105. Article 83 GDPR further states that “[e]ach supervisory authority shall ensure that the imposition
of administrative fines pursuant to this Article in respect of infringements of this Regulation
referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and
dissuasive”, before specifying the elements to be taken into account in deciding whether an
administrative fine should be imposed and in deciding the amount of this fine.
106. First of all, the company maintains that it was in no way negligent, as the shortcomings identified
resulted, in its view, from a different application and interpretation of the texts. It considers that,
in any event, the proposed sanction is disproportionate with regard to other decisions handed down
by the Restricted Committee. It thus considers that certain criteria should be taken into account
such as its level of compliance, the length of the procedure, the absence of prior formal notice and
its total cooperation. Lastly, it considers that the proposed publicity measure is unjustified, insofar
as no serious breach has been identified, no complaint has been lodged and, if it is a question of
setting a precedent in the fortune telling sector, the CNIL had already handed down a decision on
8 June 2023.
107. Firstly, the Restricted Committee recalls that, while the imposition of an administrative fine is
conditional on the establishment of a wrongful breach by the prosecuted body, this fault may result
from deliberate behaviour but also from negligence, pursuant to Article 83(2)(b) GDPR (CJEU,
Grand Chamber, 5 December 2023, Deutsche Wohnen SE et al., C-807/21; CJEU, Grand
Chamber, 5 December 2023, Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos
ministerijos et al., C-683/21).
108. The Restricted Committee considers that, in the case in point, the breaches committed by the
company reveal a certain negligence on its part. Indeed, the Restricted Committee emphasises, on
the one hand, that the rules recalled in this deliberation are subject to constant interpretation by the
CNIL. For example, while the guidelines relating to the processing of personal data implemented
for the purposes of managing commercial activities were published shortly after the inspection
operations, the recommendations it contains do not appear new, as the CNIL has already adopted,
since 2005, simplified standard NS-048 (containing in particular recommendations on the retention
period of customer data for prospecting purposes). On the other hand, the Restricted Committee
notes that the multiplicity of breaches noted shows negligence in the implementation of the
processing carried out by the company.
18
109. Secondly, the Restricted Committee considers that the criterion set forth in Article 83(2)(a) GDPR
relating to the nature, severity and duration of the breach should be applied, taking into account
the nature and scope of the processing and the number of data subjects.
110. The Restricted Committee notes first of all that the breaches of Articles 5(1)(e) and 9 GDPR
concern the fundamental principles of data protection and are thus likely to be subject to a fine of
up to €20m or 83% of the company's annual revenue of the previous period – i.e. the maximum
amount set forth by the texts –, pursuant to Article 5(5) GDPR. In this respect, the guidelines on
the calculation of administrative fines adopted by the European Data Protection Board recall that
“through this distinction, the legislator gave an initial indication of the seriousness of the breach,
in an abstract manner. The more serious the breach, the higher the fine is likely to be” (point 50).
111. The Restricted Committee then notes that the breaches identified are likely to concern a large
number of people, with the database common to and comprising more
than 1.5 million unique contacts having the status of prospect or customer. In particular, with
regard to the breach of Article L34-5 CPCE, the Restricted Committee wishes to point out that
makes extensive use of the sending of commercial prospecting messages since it
indicated that it had sent, during the first three quarters of 2022, more than 2.6 million text
messages and more than 1.3 million emails to more than 163,000 individuals whose contact details
were collected by .
112. Furthermore, the Restricted Committee notes that some of the breaches in question have the effect
of depriving the processing carried out of lawfulness. The same applies to the failure to comply
with Article 9 GDPR, as the collection of “sensitive” data is prohibited as a matter of principle,
and to the failure to comply with Article L34-5 CPCE, as commercial canvassing operations are
only lawful if the controller has valid consent.
113. The Restricted Committee also emphasises that individuals using the remote fortune telling
services offered by the company are likely to find themselves in a situation of vulnerability, which
may lead them to lower their vigilance threshold and to easily communicate certain data
concerning them, in particular sensitive data. In these circumstances, compliance with the
requirements relating to the collection of consent is essential.
114. Finally, the Restricted Committee wishes to insist on the potentially very intrusive nature of some
of the processing in question, in particular the sending of commercial prospecting messages, the
frequency and multiplicity of which are likely to cause real discomfort for the recipients, for a
particularly long period of time.
115. Thirdly, the Restricted Committee wishes to apply the criterion set forth in paragraph g) of Article
83(2) GDPR, relating to the categories of personal data concerned by the breach, insofar as the
breach of Article 9 GDPR specifically concerns the collection of sensitive data.
116. Fourthly, the Restricted Committee wishes to take into account the degree of cooperation with
the supervisory authority that the company has demonstrated, pursuant to Article 83(2)(f) GDPR.
It would appear that, following receipt of the Rapporteur’s observations in response, the company
has complied with the breach of Article L34-5 CPCE.
19
117. The Restricted Committee considers that all these elements justify the imposition of an
administrative fine.
118. With regard to the amount of the fine, the Restricted Committee would point out that, pursuant
to Article 83 GDPR, the breaches identified may be subject to an administrative fine of up to €20m
or up to 4% of the worldwide annual revenue for the previous period, whichever is higher.
119. It took the view that the company’s business and financial situation should be taken into account.
It notes in this respect that generated, for the year 2021/2022, revenue of approximately
, for a profit of approximately . The following year, this revenue came to , for
a net profit of .
120. In view of the company#’ liability, its financial capacity and the relevant criteria of Article 83(2)
GDPR referred to above, the Restricted Committee considers that a fine of one hundred and fifty
thousand (150,000) euros appears justified.
121. With regard to the publication of the sanction, the Restricted Committee considers that this is
justified in view of the seriousness of some of the breaches in question, the company’s position on
the market, the scope of the processing operations and the number of data subjects.
122. It also notes that this measure is intended in particular to inform the data subjects by the processing
carried out by the company, whether these are prospects or customers. This provision of
information would enable them to assert their rights if necessary.
123. Lastly, it took the view that this measure was proportionate given that the decision would no longer
identify the company by name two years after publication.
20
CONSEQUENTLY
The Restricted Committee of the CNIL, after deliberation, decides to:
• impose an administrative fine on in the amount of one hundred and fifty
thousand (150,000) euros for breaches of Articles 5(1)(e) and 9 of Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 and L34-5
of the French Postal and Electronic Communications Code, which breaks down as
follows:
➢ one hundred thousand (100,000) euros for breach of Articles 5(1)(e) and 9 of
Regulation (EU) 2016/679 of the European Parliament and of the Council of 7
April 2016;
➢ fifty thousand (50,000) euros for breach of Article L34-5 of the French Postal
and Electronic Telecommunications Code;
• make public, on the CNIL website and on the Légifrance website, its deliberation,
which would no longer allow the company to be identified by name at the end of a period
of two years from its publication.
The President
Philippe-Pierre Cabourdin
This decision may be appealed before the CE within two months of its notification.
21