France

Company

—

GDPR enforcement action by French Data Protection Authority (CNIL) on 2024-06-05.

Case details

Authority: French Data Protection Authority (CNIL)
Date: 2024-06-05
Controller / Processor: Company
Sector: Not assigned
Quoted Articles: Art. 5 (1) c) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The French DPA has imposed a fine on a company operating a call center. The controller had systematically recorded all incoming and outgoing calls for training, evaluation and dispute purposes. The CNIL found that such comprehensive recording violated the principle of data minimization and that random and selective recording for training purposes was sufficient.

Open original source Links to the regulator's original publication or another source.