The French DPA (CNIL) issued a fine of EUR 2,250,000 to Carrefour France due to several violations of data protection regulations, including those of the GDPR. The CNIL discovered that Carrefour France did not make it accessible or comprehensible for users of the carrefour.fr website and those wishing to join the loyalty program to access their personal data. Carrefour France also had insufficient and incomplete data regarding the data storage and transfer of data to countries outside the EU. The company also failed to comply with the storage time limits, and it stored the data of more than twenty-eight million customers who had been inactive for five to ten years, for the purpose of its loyalty program. The same happened to 750,000 users of the carrefour.fr site who were inactive for about five to ten years. The CNIL discovered that Carrefour France required almost every user to offer proof of identity when they requested a right. Though, the CNIL found out that this request for proof of identity was, most times, unjustified, because most affected users were clearly identifiable without the need for proof of identity. What’s more, Carrefour France failed to respond to a couple of requests from individuals who wanted to access their personal data. Moreover, the company did not erase the data requested by several individuals. Lastly, Carrefour France did not respond to several requests from individuals who did not agree to receiving e-mail and SMS advertising from Carrefour France.
the french dpa cnil issued a  of  to carrefour france due to several s of data protection regulations including those of the  the cnil discovered that carrefour france did not make it accessible or comprehensible for users of the carrefourfr website and those wishing to join the loyalty program to access their personal data carrefour france also had insufficient and incomplete data regarding the data storage and transfer of data to countries outside the eu the company also failed to comply with the storage time limits and it stored the data of more than twentyeight million customers who had been inactive for five to ten years for the purpose of its loyalty program the same happened to users of the carrefourfr site who were inactive for about five to ten years the cnil discovered that carrefour france required almost every user to offer proof of identity when they requested a right though the cnil found out that this request for proof of identity was most times unjustified because most affected users were clearly identifiable without the need for proof of identity what’s more carrefour france failed to respond to a couple of requests from individuals who wanted to access their personal data moreover the company did not erase the data requested by several individuals lastly carrefour france did not respond to several requests from individuals who did not agree to receiving email and sms advertising from carrefour france
 french dpa cnil issue      carrefour france due  several   data protection regulations include      cnil discover  carrefour france   make  accessible  comprehensible  users   carrefourfr website   wish  join  loyalty program  access  personal data carrefour france also  insufficient  incomplete data regard  data storage  transfer  data  countries outside  eu  company also fail  comply   storage time limit   store  data    twentyeight million customers    inactive  five  ten years   purpose   loyalty program   happen  users   carrefourfr site   inactive   five  ten years  cnil discover  carrefour france require almost every user  offer proof  identity   request  right though  cnil find    request  proof  identity   time unjustified   affect users  clearly identifiable without  need  proof  identity ’  carrefour france fail  respond   couple  request  individuals  want  access  personal data moreover  company   erase  data request  several individuals lastly carrefour france   respond  several request  individuals    agree  receive email  sms advertise  carrefour france