Background information
- Date of final decision: 15 May 2025
- National case
- Controller: CALOGA
- Legal Reference (s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing), Article 5 (Principles relating to processing of personal data)
- Decision: administrative fine
- Key words: administrative fine, consent, unsolicited communication
Summary of the Decision
Origin of the case
As the CNIL made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in this ecosystem, in particular intermediaries who resell data, known as data brokers. Thus, the CNIL carried out investigations on CALOGA which got prospect data mainly from other data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain and at the origin of the collection of data from prospective customers, known as primary collectors). CALOGA used this data to operate commercial prospecting by e-mail to prospects on behalf of its advertiser customers. It may also pass on some of this data to its customers, so that they themselves could carry out electronic canvassing.
Key Findings
Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company
Failure to comply with the obligation to respect withdrawal of (Article L. 34-5 of the CPCE as referred to in Article 7 of GDPR): under the system implemented by CALOGA, it was not possible for prospects to unsubscribe with a single click from the various CALOGA’ databases in which they were registered. It was therefore not as easy for prospects to withdraw their consent as it was to give it.
Failure to comply with the obligation to have a legal basis for processing data (Article 6 of the GDPR): As part of its activity as a data broker, the company also transmitted databases to other partners, who sent commercial prospecting by e-mail for their advertiser customers. It based this data transmission on the legal basis of legitimate interest. However, this processing must be based on the consent of the data subjects, which CALOGA did not obtain.
Failure to comply with the obligation to define and respect a data retention period proportionate to the purpose of the processing (Article 5-1-e of the GDPR): each time a prospect opened an email from the company - even inadvertently - the company extended the storage of this prospect's data in its databases, potentially without limitation.
Decision
Based on the findings of the inspection, the restricted committee – the CNIL body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR).
It imposed on CALOGA a €80 000 fine which was made public. The amount of the fine took into account the large number of people involved, the company's historical position on the market, the financial benefit derived from the breaches and the complete cessation of activity of the company in 2024.
For further information:
• Courtiers en données : sanction de 80 000 euros à l’encontre de la société CALOGA (French)
• Data brokers: CALOGA fined €80,000 (English)
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.