FACTS
The CNIL and several European supervisory authorities received complaints about the difficulties encountered by individuals in exercising their data subject rights with ACCOR. As the main supervisory authority, the CNIL carried out several investigations, which revealed that customers who made a reservation (on site and online) with the ACCOR group were automatically sent a newsletter containing commercial offers from partners, as the box relating to consent was pre-selected. In addition, the CNIL’s investigations revealed technical anomalies which meant that data subjects were unable to effectively opt-out of such messages.
As the data processing involved individuals located across several European countries, the CNIL submitted a draft decision to the supervisory authorities involved. However, the Polish supervisory authority disagreed with the amount of the fine to be imposed on ACCOR by the CNIL, which led to a dispute between the two authorities. The European Data Protection Board ("EDPB") was consulted and instructed the CNIL to increase the amount of the fine to be issued, in order to ensure dissuasive effect, in accordance with Article 83 of the GDPR.
As a consequence of the binding decision of the EDPB, the CNIL imposed a fine of 600,000 Euros on ACCOR. Moreover, details of the fine were made availably publicly, thus creating potential reputational risk and damage for ACCOR.
BREACHES
The CNIL's decision highlights the numerous breaches by ACCOR.
Noncompliance with e-privacy rules:
Firstly, it found a breach of the principle requiring prior consent to be obtained from the recipients of e-communications, which meant that ACCOR had failed to comply with Article L. 34-5 of the French Post and Electronic Communications Code. Although it would have been possible for ACCOR to send out e-marketing communications about its own products and services without necessarily collecting the consent of the individuals, in the present case, the e-marketing communications related to third party offers. In this case, the ability for recipients to object to e-marketing must always be an option. The CNIL found that since ACCOR customers were automatically subscribed to the ACCOR newsletter due to the pre-selected box, their consent has not been collected in a free, specific, unambiguous and informed manner. Thus, the consent was not valid.
GDPR breaches:
The CNIL found that ACCOR did not provide data subjects with the necessary information when creating a customer account or when joining the ACCOR Group's customer fidelity program. The GDPR points out that data subjects must have easy access to information about their personal data, as part of the controller's transparency obligation and to ensure that their consent is sufficiently free and informed. The company also failed to state that consent would be the applicable lawful basis when promoting third party products or services. This resulted in breaches of the obligation to inform individuals, as set out in Articles 12 and 13 of the GDPR.
In addition, the CNIL noted further GDPR breaches regarding the exercise of data subjects' rights. ACCOR did not respect the one-month time limit required for responding to access requests. By failing to respond to the request within the time-limit, ACCOR breached Articles 12 and 15 of the GDPR. The CNIL found that ACCOR had also infringed Articles 12 and 21 of the GDPR regarding the right to object. Furthermore, the CNIL noted that individual requests to stop receiving e-marketing messages from ACCOR were not complied with. In fact, the CNIL demonstrated that the unsubscribe links in the marketing emails sent by ACCOR did not work, thus rendering the opt-out and unsubscribe requests ineffective.
Finally, the CNIL found that ACCOR failed to fulfill the obligation under Article 32 of the GDPR, for ensuring the security of personal data through appropriate technical and organizational and means. Indeed, ACCOR allowed customers to access their data using an 8-character password with only two different types of characters, meaning that the level of security of the passwords was insufficient for the amount of data accessible. Finally, the CNIL also reproaches ACCOR for asking an individual to provide their ID document via email without encryption, and therefore failing to secure the personal data concerned.
Based on these infringements, the CNIL fined ACCOR 600,000 Euros, including 100,000 Euro for breaches relating to non-compliance with e-marketing rules and 500,000 Euros for those relating to the GDPR breaches.
Since the end of the investigation and following the CNIL's sanction, ACCOR has remedied the reported breaches.
Article provided by INPLP member: Charlotte Gerrish (Gerrish Legal SARL, France)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
