Privacy & Information Security Law Blog

On March 28, 2023, the French Data Protection Authority (the “CNIL” or “French DPA”) announced a €125,000 fine on the e-scooter rental company Cityscoot for breaching EU and French data protection rules, in particular in the context of geolocation and use of Google reCAPTCHA. The fine was imposed on March 16, 2023.

The fine comes as part of the CNIL’s efforts to prioritize investigation and enforcement in areas related to French citizens’ everyday lives.

In its investigation, the CNIL found that Cityscoot collected the geolocation of rented e-scooters every 30 seconds and kept a record of this information. The French DPA determined that in doing so, Cityscoot breached the obligation of data minimization under Article 5 of the EU General Data Protection Regulation (“GDPR”), as this type of processing is highly intrusive and the service could be provided without collecting its users’ geolocation on an almost permanent basis.

The CNIL also addressed Cityscoot’s use of Google’s reCAPTCHA when creating an account, logging in or recovering a password. The French DPA determined that this mechanism works by collecting hardware and software information from the data subject’s device and sharing it with Google for analysis, and that Cityscoot failed to obtain the required consent of the data subject to this under Article 82 of the French Data Protection Act.

Finally, the French DPA investigated Cityscoot’s data processing agreements, finding that three of them did not contain all of the information required under Article 28 of the GDPR.

Read the decision (in French) and the press release (in English and French).