Fine in the amount of 125 000 euros applied by the French Supervisory Authority to CITYSCOOT for the disproportionately infringement on the privacy of its customers by geolocating them almost permanently
479 Views
The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 125 000 euros applied by the French Supervisory Authority (CNIL) to CITYSCOOT for the disproportionately infringement on the privacy of its customers by geolocating them almost permanently.
CNIL carried out investigations on the company CITYSCOOT, which rents scooters for a short period. The investigations focused in particular on the data collected as well as on the information and consent obtained from users before processing technical information on their mobile phone or computer.
Following the investigations, CNIL found several violations, such as:
· Failure to comply with the obligation to ensure data minimisation (Article 5.1.c of the GDPR);
· Failure to comply with the obligation to provide a contractual framework for the processing operations carried out by a processor (Article 28.3 of the GDPR);
· Failure to inform the user and obtain his or her consent before writing and reading information on his or her personal device (Article 82 of the French Data Protection Act).
On the basis of these findings, CNIL imposed a fine in the amout of 125 000 euros to CITYSCOOT, which was made public. This decision was taken in cooperation with the Spanish and Italian data protection authorities, as CITYSCOOT also offers these services in these countries. The amount of the penalty takes into account the company’s turnover, the number of users (about 250 000 in 2022) and the seriousness of the breaches identified, but also the measures taken by the company to remedy them during the procedure.
The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.
