The French data protection authority ('CNIL') announced, on 30 June 2022, that it had issued, on 23 June 2022, Deliberation No. SAN-2022-011 of 23 June 2022, in which it imposed a fine of €1 million against TotalEnergies Electricité et Gaz France, for violations of Articles L. 34-5 of the Post and Electronic Communications Code (last amended in 2016) ('CPCE') and Articles 12, 14, 15, and 21 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following the receipt of various complaints.

Background to the case

In particular, CNIL received complaints concerning issues with TotalEnergies facilitating data subject access requests and requests to object to the receipt of direct marketing communications. Accordingly, CNIL's Restricted Committee launched an investigation into the same.

Findings of CNIL

In light of the above, the deliberation determines that TotalEnergies did not provide users with the opportunity to object to the receipt of marketing communications via the online subscription form, in violation of Article L. 34-5 of the CPCE. Furthermore, CNIL found that TotalEnergies had not communicated vital information to data subjects relating to the processing of their personal data, thus violating Article 14 of the GDPR. Further to this, CNIL highlighted that TotalEnergies did not facilitate data subject access requests or requests exercising the right to object, which violates Articles 15 and 21 of the GDPR respectively. In addition, CNIL outlined that TotalEnergies had not responded to data subject requests within the one month timeframe, violating Article 12 of the GDPR.

Outcomes

Consequently, CNIL imposed the aforementioned administrative fine against TotalEnergies and noted that the deliberation may be appealed before the Conseil d'Etat within two months of the date of notification of the same deliberation.

You can read the press release here and the deliberation here, both only available in French.

UPDATE (12 July 2022)

EDPB publishes English summary of CNIL's decision fining TotalEnergies

The European Data Protection Board ('EDPB') published, on 6 July 2022, a summary of the decision in English.

You can read the summary here.