Administrative fine of €525,000 imposed by the French Data Protection Authority on HUBSIDE.STORE for non-compliant commercial marketing

The National Centre for Personal Data Protection (CNPDCP), for information and enforcement purposes, communicates about the administrative fine of 525 000 euros imposed by the French Data Protection Authority (CNIL) on HUBSIDE.STORE for breach of Article 6 (Lawfulness of processing) and Article 14 (Information to be provided where personal data have not been obtained from the data subject) of the GDPR.

HUBSIDE.STORE conducts telephone and SMS prospecting campaigns to promote products sold in its stores (mobile phones, laptops, etc.), acquiring data from data brokers and publishers of competing product testing websites.

As a result of the investigations, the CNIL found several violations of the GDPR, such as:

• Failure to have a legal basis for processing personal data (Article 6 GDPR);

• The misleading aspect of the data collection forms used by data brokers responsible for data collection did not allow valid consent to be obtained from data subjects. Therefore, HUBSIDE.STORE did not have a valid legal basis for collecting data (Article 6 of the GDPR) for commercial marketing via telephone calls. It is also a violation of the French Postal and Electronic Communications Code (Article L.34-5) for the purpose of marketing via SMS;

• Failure to comply with the obligation to inform individuals (Article 14 of the GDPR). Investigations revealed that individuals contacted by telephone did not have all the necessary information on the collection and use of their personal data (e.g. the identity and contact details of the company, the purposes for which the data was used, the retention periods, the source of the data, their rights or even the possibility to lodge a complaint with the French Data Protection Authority).

In this context, the CNIL imposed an administrative fine of €525,000 on HUBSIDE.STORE, which has been made public. The CNIL cooperated closely with its counterparts (Belgium, Italy, Spain, Portugal) in examining the draft decision under the single procedure, as HUBSIDE.STORE processes data from customers and potential customers in several EU Member States. The amount of the fine, which represents approximately 2% of the company’s turnover, was decided according to the seriousness of the infringement and the responsibility assumed by the company using the data collected. The CNIL also took into account the fact that HUBSIDE.STORE made extensive use of commercial marketing.

The NCPDP, as the national surveillance authority for the processing of personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.