Background information
- Date of final decision: 29 December 2023
- National case
- Legal Reference(s): Article 6 (Lawfulness of processing), Article 30 (Records of processing activities)
- Decision: Administrative fine
- Key words: Consent, Record of processing activities
Summary of the Decision
Origin of the case
As part of its priority topic of investigation on commercial prospecting in 2022, the French Supervisory Authority (SA) focused on the practices of professionals in the sector, in particular those who resell data, including many intermediaries in this ecosystem, known as data brokers.
On this occasion, the French SA decided to initiate investigations into Tagadamedia, which mainly operates online competition sites and product testing websites, through which it collects data from prospects.
Key Findings
Tagadamedia collects data from prospects through forms it offers on its websites to participate in competitions or product testing. This data is then sent to the company's partners for commercial prospecting. Although the company claims to collect consent for its data processing, the forms used do not allow consent to be collected in compliance with the requirements of the GDPR.
During the investigations, the company provided the French SA with two examples of forms for collecting data from prospective customers. However, the presentation of these forms did not allow free, informed and unambiguous consent to be obtained. In fact, the highlighting of the button allowing users to give their consent in contrast to that of the button allowing users not to give their consent, or the incomplete text and reduced size, strongly encouraged users to agree to the transmission of their data to partners.
The company submitted the French SA a new form during the sanction procedure. The consent obtained by this new form still did not allow to obtain a valid consent, thereby depriving the processing operation of any legal basis.
The French SA found two breaches of the GDPR:
- Failure to comply with the obligation to have a legal basis for the processing of data (Article 6 of the GDPR)
- Failure to comply with the obligation to implement a record of processing activities (Article 30 of the GDPR)
Decision
The French SA imposed a fine of EUR 75,000 euros on Tagadamedia.
For further information:
• national decision (FR) - Courtiers en données : sanction de 75 000 euros à l’encontre de la société TAGADAMEDIA
• national decision (EN) - Data brokers: TAGADAMEDIA fined €75,000
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.