Fine in the amount of 175 00 euros applied by the French Data Protection Authority to UBEEQO International for the illegally processing of personal data

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 175 00 euros applied by the French Data Protection Authority (DPA) to UBEEQO International for the illegally processing of personal data.

This case is part of the priority control theme in 2020 relating to the new uses of geolocation data in the context of mobility. In this context, the French DPA controlled the company UBEEQO International, whose activity is the rental of vehicles for a short period. The investigations focused in particular on the data collected, the defined retention periods, the information provided to individuals and the security measures implemented.

Following the investigations, French DPA found several violations, such as:

·        Failure to comply with the obligation to ensure data minimisation (Article 5.1.c of the GDPR).

·        Failure to define and respect a proportionate data retention period (Article 5.1.e of the GDPR).

·        Failure to inform individuals (Article 12 of the GDPR).

 On the basis of these findings, the restricted committee – the CNIL’s body in charge of issuing sanctions – in cooperation with the other European authorities concerned (in Belgium, Denmark, Spain, Italy and Germany) imposed a fine of 175 000 euros to UBEEQO International, which was made public.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.