Background information
- Date of final decision: 24 November 2022
- Cross-border case or national case: National case
- Controller: EDF (ELECTRICITE DE FRANCE).
- Legal Reference:
- obligation to collect consent of individuals to receive commercial prospecting by e-mail (Articles L. 34-5 of the French Postal and Electronic Communications Code and 7 of the GDPR)
- obligations of information (Articles 13 and 14 of the GDPR) and to respect the exercise of rights (Articles 13 and 14 of the GDPR)
- obligation to ensure security of personal data (Article 32 of the GDPR)
- Decision: administrative fine
- Key words: electric utility
Summary of the Decision
Origin of the case
The CNIL, French Supervisory Authority has received many complaints regarding difficulties encountered by individuals in having their rights considered by the company EDF, which is the first electric utility in France.
Key Findings
- Failure to collect consent of individuals to receive commercial prospecting by e-mail (Articles L. 34-5 of the French Postal and Electronic Communications Code and 7 of the GDPR)
- Failures to inform (Articles 13 and 14 of the GDPR) and to respect the exercise of rights (Articles 13 and 14 of the GDPR)
- Failure to ensure security of personal data (Article 32 of the GDPR)
Decision
Based on findings from investigations carried out, the restricted committee – body responsible for imposing sanctions – considered that the company failed to comply with its obligations provided for by the General Data Protection Regulation (GDPR) and the French Postal and Electronic Communications Code. It imposed a fine of 600 000 euros on EDF and made it public.
The amount of the fine was decided considering the breaches observed and the cooperation by the company and all the measures it has taken during the proceedings to reach compliance with all alleged breaches.
For further information:
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.