info@edpo.com
Fines of 2,250,000 euros and 800,000 euros for Carrefour France and Carrefour Banque
FRENCH DATA PROTECTION AUTHORITY – NEWS
https://www.cnil.fr/fr/sanctions-2250000-euros-et-800000-euros-pour-carrefour-france-carrefour-banque
Fines of 2 250 000 euros and 800 000 euros for the CARREFOUR FRANCE and CARREF OUR BANQUE companies
26 November 2020
After receiving several complaints, the CNIL has sanctioned two companies of the CARREFOUR group for breaches of the GDPR, concerning, amongst others, the information provided to individuals and respect for their rights.
After receiving several complaints against the CARREFOUR group, the CNIL carried out inspections between May and July 2019 at CARREFOUR FRANCE (retail sector) and CARREFOUR BANQUE (banking sector). On this occasion, the CNIL noted shortcomings in the processing of data on customers and potential users. The President of the CNIL therefore decided to initiate sanction proceedings against these companies.
At the end of this procedure, the restricted committee – the CNIL body responsible for imposing sanctions – indeed considered that the companies had failed to comply with several obligations under the GDPR.
It therefore fined CARREFOUR FRANCE 2 250 000 euros and CARREFOUR BANQUE 800 000 euros. However, it did not issue an injunction as it noted that significant efforts had been made to bring all the identified breaches into compliance.
Breach of the obligation to inform individuals (Article 13 of the GDPR)
The information provided to users of the carrefour.fr and carrefour-banque.fr websites, as well as to people wishing to join the loyalty program or the Pass card, was not easily accessible (access to the information was too complicated, in very long documents containing other information), nor easily understandable (information written in general and imprecise terms, sometimes using unnecessarily complicated wording). Moreover, it was incomplete with regards to the duration of data retention.
Concerning the carrefour.fr website, the information was also insufficient regarding data transfers outside the European Union and the legal basis for the processing operations (files).
On this point, the companies modified their information notices and websites during the procedure to bring themselves into compliance.
Breach relating to cookies (Article 82 of the French Data Protection Act)
The CNIL noted that, when a user connected to the carrefour.fr or carrefour-banque.fr websites, several cookies were automatically placed on the user’s terminal, before any action was taken on his/her part. Several of these cookies were used for advertising purposes, and the user’s consent should have been obtained before they were placed.
During the procedure, the companies updated this processing on their website. No more advertising cookies are now placed before the user has given his/her consent.
Breach of the obligation to limit the data retention period (Article 5.1.e of the GDPR)
CARREFOUR FRANCE did not respect the data retention periods it had set. The data of more than twenty-eight million customers who had been inactive for five to ten years was being kept as part of the loyalty program. The same happened for 750,000 users of the carrefour.fr website who had been inactive for five to ten years.
Furthermore, in this case, the restricted committee considers that a retention period of 4 years for customer data after their last purchase, is excessive. Indeed, this duration, initially set by the company, exceeds what appears necessary in the field of mass retailing, given the consumption habits of customers who mainly make regular purchases.
During the procedure, CARREFOUR FRANCE committed significant resources to make the necessary changes to bring it into compliance with the GDPR. Amongst others, all data that was too old has been deleted.
Breach of the obligation to facilitate the exercise of rights (Article 12 of the GDPR)
CARREFOUR FRANCE required, except for opposition to commercial prospecting, proof of identity for any request to exercise a right. This systematic request was not justified as there was no doubt as to the identity of the persons exercising their rights. In addition, the company was unable to process several requests to exercise rights within the timeframe required by the GDPR.
On these two points, the company modified its practices during the procedure. In particular, it deployed significant human and organizational resources to respond to all requests received within less than one month.
Failure to respect rights (Articles 15, 17 and 21 of the GDPR and L34-5 of the Postal and Electronic Communications Code)
Firstly, CARREFOUR FRANCE did not respond to several requests from people wishing to access their personal data. The company approached all the people concerned during the procedure.
Secondly, in several cases, the company did not proceed with the deletion of data requested by several people when it should have done so. On this point, too, the company complied with all requests during the proceedings.
Finally, the company did not take into account a number of requests from people who had objected to receiving advertising by SMS or e-mail, including due to occasional technical errors. The company complied during the procedure on this point as well.
Breach of the obligation to process data fairly (Article 5 of the GDPR)
When a person subscribing to the Pass card (a credit card that can be linked to the loyalty account) also wished to join the loyalty program, they had to tick a box indicating that they agreed to CARREFOUR BANQUE communicating their last name, first name and e-mail address to “Carrefour fidélité”. CARREFOUR BANQUE explicitly indicated that no other data would be transmitted. However, the CNIL noted that other data was indeed transmitted, such as postal address, telephone number and the number of children, although the company had committed to not transmit any other data.
On this point, the company changed its practices during the procedure. It has completely overhauled its online subscription process for the Pass card and people are now informed of all the data transmitted to CARREFOUR FRANCE.
EU GDPR Quick Guide to GDPR Fines and Sanctions
The EU’s General Data Protection Regulation (GDPR) was one of the first privacy laws to compel broad organizational compliance, largely...
England and Wales High Court rules that the GDPR Art. 27 Representative is not liable for its clients’ actions
The England and Wales High Court of Justice (May 28th 2021): the GDPR Article 27 Representative is not liable for its client’s actions. On...
Fine of 525,000 euros imposed on non-EU company for failure to appoint EU Representative
UNOFFICIAL ENGLISH TRANSLATION DUTCH DATA PROTECTION AUTHORITY – NEWS...
About the author
Jane Murphy
The General Data Protection Regulation (GDPR) continues to apply to many US companies in 2025, even if they do not have a physical presence in the European Union. Despite years of guidance and enforcement, the same misunderstandings keep reappearing. Here are five of the most common GDPR mistakes US companies make — and how to avoid them.
Mistake 1 – Confusing the Data Protection Officer (DPO) with the EU GDPR Representative
An EU GDPR Representative is a local contact point for data protection authorities and individuals in the EU. Non-EU companies that are subject to the GDPR must appoint a representative to ensure smooth communication and compliance.
A Data Protection Officer (DPO) is responsible for overseeing a company’s internal data protection strategy and ensuring compliance with the GDPR. The DPO monitors data processing, conducts audits, and trains staff.
The DPO works inside the organisation, while the GDPR Representative is based in the EU and acts as an external contact point. Many US companies confuse the two roles, but under the GDPR, they are separate obligations and sometimes both are required.
Mistake 2 – Misunderstanding the extraterritorial scope of the GDPR
The GDPR applies to non-EU companies if they offer goods or services to individuals in the EU or monitor their behaviour online. This applies regardless of where the company is located.
Selling products to EU customers, operating an EU-facing website in EU languages, accepting payments in euros, or tracking EU visitors with cookies or analytics tools can all trigger GDPR obligations.
Mistake 3 – Incorrectly relying on the Privacy Shield (now EU-US Data Privacy Framework)
The Privacy Shield was an agreement that allowed certified US companies to transfer personal data from the EU to the US. In 2020, it was invalidated by the Court of Justice of the European Union in the Schrems II decision.
In 2023, the EU-US Data Privacy Framework (DPF) replaced the Privacy Shield. While participation in the DPF can help facilitate transatlantic data transfers, it does not exempt companies from GDPR compliance.
US companies must ensure that data transfers are lawful under the GDPR. This may involve joining the DPF, using Standard Contractual Clauses (SCCs), or implementing other approved safeguards.
Mistake 4 – Incomplete or unclear privacy policies
The GDPR requires privacy policies to be clear, accessible and transparent. They must explain what personal data is collected, how it is used, the legal basis for processing, and the rights of data subjects.
Many US companies omit details such as data retention periods, contact information for the EU Representative, or instructions on how to exercise data subject rights.
Mistake 5 – Underestimating GDPR fines and enforcement
Data protection authorities have issued fines to companies of all sizes, including non-EU businesses. In 2025, penalties for non-compliance remain high — up to €20 million or 4% of annual global turnover, whichever is higher.
Regular compliance reviews Data Protection Impact Assessments (DPIAs), staff training, and appointing an EU GDPR Representative can help mitigate risks.
How EDPO can help your business stay GDPR compliant
EDPO acts as your official EU GDPR Representative, ensuring compliance with Article 27 of the GDPR and facilitating communication with EU authorities.
For companies targeting the UK market, EDPO also offers UK GDPR Representative services to ensure compliance with the UK’s data protection regime.
Follow us on Linkedin for daily breaking GDPR news!
The General Data Protection Regulation (GDPR) continues to apply to many US companies in 2025, even if they do not have a physical presence in the European Union. Despite years of guidance and enforcement, the same misunderstandings keep reappearing. Here are five of the most common GDPR mistakes US companies make — and how to avoid them.
Mistake 1 – Confusing the Data Protection Officer (DPO) with the EU GDPR Representative
An EU GDPR Representative is a local contact point for data protection authorities and individuals in the EU. Non-EU companies that are subject to the GDPR must appoint a representative to ensure smooth communication and compliance.
A Data Protection Officer (DPO) is responsible for overseeing a company’s internal data protection strategy and ensuring compliance with the GDPR. The DPO monitors data processing, conducts audits, and trains staff.
The DPO works inside the organisation, while the GDPR Representative is based in the EU and acts as an external contact point. Many US companies confuse the two roles, but under the GDPR, they are separate obligations and sometimes both are required.
Mistake 2 – Misunderstanding the extraterritorial scope of the GDPR
The GDPR applies to non-EU companies if they offer goods or services to individuals in the EU or monitor their behaviour online. This applies regardless of where the company is located.
Selling products to EU customers, operating an EU-facing website in EU languages, accepting payments in euros, or tracking EU visitors with cookies or analytics tools can all trigger GDPR obligations.
Mistake 3 – Incorrectly relying on the Privacy Shield (now EU-US Data Privacy Framework)
The Privacy Shield was an agreement that allowed certified US companies to transfer personal data from the EU to the US. In 2020, it was invalidated by the Court of Justice of the European Union in the Schrems II decision.
In 2023, the EU-US Data Privacy Framework (DPF) replaced the Privacy Shield. While participation in the DPF can help facilitate transatlantic data transfers, it does not exempt companies from GDPR compliance.
US companies must ensure that data transfers are lawful under the GDPR. This may involve joining the DPF, using Standard Contractual Clauses (SCCs), or implementing other approved safeguards.
Mistake 4 – Incomplete or unclear privacy policies
The GDPR requires privacy policies to be clear, accessible and transparent. They must explain what personal data is collected, how it is used, the legal basis for processing, and the rights of data subjects.
Many US companies omit details such as data retention periods, contact information for the EU Representative, or instructions on how to exercise data subject rights.
Mistake 5 – Underestimating GDPR fines and enforcement
Data protection authorities have issued fines to companies of all sizes, including non-EU businesses. In 2025, penalties for non-compliance remain high — up to €20 million or 4% of annual global turnover, whichever is higher.
Regular compliance reviews Data Protection Impact Assessments (DPIAs), staff training, and appointing an EU GDPR Representative can help mitigate risks.
How EDPO can help your business stay GDPR compliant
EDPO acts as your official EU GDPR Representative, ensuring compliance with Article 27 of the GDPR and facilitating communication with EU authorities.
For companies targeting the UK market, EDPO also offers UK GDPR Representative services to ensure compliance with the UK’s data protection regime.