France

GIE INFOGREFFE

250,000 €

GDPR enforcement action by French Data Protection Authority (CNIL) on 2022-09-13.

Rank · Sector

#25

of 357 in Public Sector and Education

Rank · France

#41

of 74

Rank · All fines

#321

of 3,051

Case details

Authority: French Data Protection Authority (CNIL)
Date: 2022-09-13
Controller / Processor: GIE INFOGREFFE
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) e) GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The French DPA has imposed a fine of EUR 250,000 on GIE INFOGREFFE. The portal operates a website where people can access legal information about companies and order documents certified by the commercial courts.
As part of its investigation, the DPA found that the personal data of 25% of members and subscribers, such as bank details, surnames, first names, addresses and telephone numbers, were kept for longer than intended (36 months). The DPA considered this to be a violation of Art. 5 (1) e) GDPR.

In addition, the DPA found that the portal did not require the use of a secure password when creating an account, resulting in 3.7 million accounts not having a sufficiently secure password.

Furthermore, the portal transmitted passwords that allowed access to accounts unencrypted via email. Besides, the portal also stored the passwords and secret questions and answers used during the process of resetting passwords by users in a database without encryption.

For this reason, the DPA found that the portal had failed to implement adequate technical and organizational measures to protect personal data.

Open original source Links to the regulator's original publication or another source.