Sanction RGPD French Data Protection Authority (CNIL) — ACTIVE ASSURANCES (car insurer) : 180 k€ (2019)
- Autorité de contrôle
- French Data Protection Authority (CNIL)
- Pays
- France
- Entreprise / secteur
- ACTIVE ASSURANCES (car insurer)
- Montant de l'amende
- 180 k€
- Date de la décision
- 25 juillet 2019
- Fondement juridique
- Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
Large amount of customer accounts, clients' documents (including copies of driver's licences, vehicle registration, bank statements and documents to determine whether a person had been the subject of a licence withdrawal) and data were easily accesible online. The CNIL, between others, critizised the password management (unauthorized access was possible without any authentication).