GDPR fine of 75,000€ for one SME with 50 employees
The TAGADAMEDIA company was sanctioned for having collected prospect data without valid consent and poor keeping of the processing register.
⏭ The context
The CNIL, in its focus on commercial prospecting in 2022, scrutinized the practices of professionals in the sector, particularly those involved in the resale of data. TAGADAMEDIA was subject to an inspection, revealing breaches of the GDPR.
💶 Sanctions imposed
The fine of 75,000 euros was decided due to breaches of GDPR obligations. The CNIL also ordered the implementation of a compliant collection form under penalty of 1,000 euros per day of delay.
Here are the 2 Shortcomings:
❌ Non-Compliant Consent (Article 6 of the GDPR)
TAGADAMEDIA collected data from prospects claiming to base processing on the collection of consent. However, the forms used did not allow consent to be obtained in accordance with GDPR requirements. The misleading appearance strongly encouraged users to accept the transmission of their data to partners. Even with a new form transmitted during the sanction procedure, the consent obtained still did not meet the standards, thus depriving the treatment of the legal basis.
❌ Register of Non-Compliant Processing Activities (Article 30 of the GDPR):
A breach was also noted regarding the implementation of the register of processing activities. The register shared with a second company did not specify which of the two acted as data controller.
Solutions for avoid these shortcomings with the all-in-one Data Comply One platform (formerly Mission RGPD)
✅ Compliant Consent (Article 6 of the GDPR)
From your interface:
1️⃣ Complete and complete the website audit questionnaire
2️⃣ Correct any shortcomings with the tools and resources made available
3️⃣ Make an appointment with your GDPR expert to verify compliance #rgpd from your website and collection forms
✅ Register of Compliant Processing Activities (Article 30 of the GDPR)
From your interface:
1️⃣ Create your processing records for several companies in just a few clicks
2️⃣ Make an appointment with your GDPR expert to take stock of your processing records if necessary
