Privacy & Information Security Law Blog

On June 6, 2019, the French Data Protection Authority (the “CNIL”) announced that it levied a fine of €400,000 on SERGIC, a French real estate service provider, for failure to (1) implement appropriate security measures and (2) define data retention periods for the personal data of unsuccessful rental candidates.

Background

SERGIC provides real estate services through its website, which allows rental candidates to download any supporting documentation that may be required for the allocation of housing, among other functions.

On August 12, 2018, the CNIL received a web user complaint that, when logged in to his personal account, the user was able to access the documents of other users by slightly amending the URL displayed in the browser bar. On September 7, 2018, the CNIL’s investigation revealed that documents provided by rental candidates were freely accessible without prior authentication. This included documents such as copies of ID cards, social security cards, tax notices, certificates delivered by the family benefits agency, divorce decrees, account statements and banking information. On September 13, 2018, the CNIL carried out an on-site inspection, revealing that SERGIC knew about the security vulnerability since March 2018. The CNIL further noted that the company had begun working on it but the vulnerability was definitively corrected only on September 17, 2018. The CNIL also found that SERGIC indefinitely kept all of the documents of unsuccessful rental candidates in an active database.

The CNIL’s Decision

Against that background, the CNIL initiated a sanctions procedure for alleged failure to (1) implement appropriate security measures and (2) retain personal data for no longer than necessary under Articles 32 and 5 of the EU General Data Protection Regulation (“GDPR”), respectively. In accordance with the CNIL’s rules of procedure, the Chairwoman of the CNIL appointed a rapporteur among the members of the CNIL to prepare a report, on the basis of which the CNIL adopted its decision.

In its decision, the CNIL held that SERGIC did not comply with Article 32 of the GDPR as the company did not have in place a prior authentication procedure to ensure that the individuals accessing the documents were those who downloaded the documents. According to the CNIL, this is a basic security measure that the company should have implemented. In the CNIL’s view, the violation was aggravated by the types of the data made available and the lack of diligence of the company in addressing the vulnerability.

Additionally, the CNIL concluded that personal data of unsuccessful rental candidates should not have been retained in an active database for more than three months after the housing was allocated. The CNIL noted that data retention periods must be determined based on the purpose of the data processing. According to the CNIL, when that purpose is achieved and there is no other purpose that would justify further retaining the personal data in an active database, the data must be either (1) erased or (2) archived on a “distinct support” (e.g., a separate database), if it is necessary to further retain the data for compliance with a legal retention obligation or for litigation or pre-litigation purposes. The CNIL stressed that the archiving period must also be limited to the strict minimum. Given that, in this context the personal data could have been retained longer than three months only if archived on a separate database.

The CNIL therefore decided to impose a fine of €400,000 on SERGIC for failure to comply with Articles 32 and 5 of the GDPR. When setting the amount of the fine, the CNIL took into account the seriousness of the infringements, the company’s lack of diligence in addressing the security vulnerability and the fact that the documents made available revealed very intimate details of the rental candidates’ lives. However, the CNIL reduced the fine from €900,000 (as initially proposed by the rapporteur) to €400,000, taking into account the size of the company and its financial capacity.