Wednesday, March 10, 2021
The French Supervisory Authority (CNIL) wrapped up 2020 with a EUR 20,000 fine against NESTOR, a French food preparation and delivery company catering to office employees (see full decision here in French).
1
Various breaches of the General Data Protection Regulation (GDPR)
2 and the ePrivacy Directive regarding the processing of prospects and clients’ personal data were highlighted by the CNIL, most notably:
3
4 whether:
Upon indirect collection through external sources;
The failure to properly address data subjects’ access requests (DSAR).
5
While the fine is rather limited in view of the maximum potential amount of EUR 20 million or four percent of the turnover (whichever the greater), this decision remains an opportunity to look at web scraping and direct marketing practices, which are rapidly developing.