Administrative fine in the amount of 1 million euros applied by the French Supervisory Authority to TotalEnergies Électricité et Gaz France for the illegally processing of personal data

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of 1 million euros applied by the French Supervisory Authority (CNIL) to TotalEnergies Électricité et Gaz France for the illegally processing of personal data.

CNIL has received several complaints concerning the difficulties encountered by individuals in having their requests for access to their data and opposition to receiving calls for the purposes of direct marketing taken into account by the French energy producer and supplier, TotalEnergies Électricité et Gaz France.

Following the investigations, CNIL found several violations, such as:

·         Failure to comply with the obligation to inform individuals solicited (article 14 of the GDPR).

·         Failure to respect the right of access to data (article 15 GDPR) and the right to object of data subjects (article 21 GDPR).

·         Failure to comply with the obligations relating to the modalities for exercising rights (Article 12 of the GDPR).

In this context, CNIL imposed to TotalEnergies Électricité et Gaz France an administrative fine in the amount of 1 million euros and made public the decision. The amount of this fine was decided in the light of the breaches identified as well as all the measures taken by the company during the procedure to bring itself into compliance.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.