- France’s data protection authority, the Commission nationale de l'informatique et des libertés, issued a 600,000 euro fine to utility company EDF. The fine was related to three core violations of the EU General Data Protection Regulation. The violations included failing to demonstrate prior consent as part of its “commercial prospecting campaign by electronic means,” failing to inform customers of their legal base for each use of personal data and failing to secure personal data after passwords for 25,000 accounts slated to receive an “energy bonus” were not stored securely until July.
- Ireland's Data Protection Commission announced a 265 million euro fine to Meta over alleged GDPR violations. The fine is the third-largest GDPR penalty. The DPC's initial investigation, opened in April 2021, examined the alleged exposure of a data set of personal information from Meta's Facebook. The probe concluded the platform violated Articles 25(1) and 25(2) of the GDPR.
- Italy's data protection authority, the Garante, fined perfume chain Douglas Italia 1.4 million euros for data protection violations. The Garante said the company maintained data of more than 3 million customers without requesting consent for processing. In addition to the fine, the company is required to adopt compliance measures regarding data retention times and data processing for marketing and profiling purposes, and must delete data from the past 10 years.
Comments
If you want to comment on this post, you need to login.