Precedent corpus / CNIL (France)
DE PARTICULIER A PARTICULIER (PAP)
CNIL (France) case SAN-2024-002, decided 2024-01-31. EUR 100,000.
What the regulator decided
PAP retained user account data and inactive-user data beyond the period necessary for the purposes for which they were processed, breaching Article 5(1)(e) GDPR; failed to provide complete information to data subjects in breach of Article 13; did not frame its relationship with a processor with the contractual safeguards required by Article 28; and stored credentials without an appropriately strong hashing function and in plain text in some logs, breaching Article 32.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049128617Archived snapshot
Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.
https://web.archive.org/web/20250331054141/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049128617ConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
Real-estate-classifieds publisher (pap.fr). Cite when the scanner narrative needs the precedent that inactive-user retention beyond a documented period is itself an Article 5(1)(e) breach, and that weak credential storage triggers Article 32 even when no external compromise occurred.
Verification trail
- Verified by
- donal
- Verified at
- 2026-05-27
- Review due
- 2026-11-27
Cite this case
Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.
@misc{consentmark-precedent-cnil-san-2024-002,
author = {{ConsentMark}},
year = {2024},
title = {CNIL (France) SAN-2024-002 - DE PARTICULIER A PARTICULIER (PAP)},
howpublished = {\url{https://www.consentmark.com/precedent/cnil-san-2024-002}},
note = {ConsentMark methodology v1.3}
}ConsentMark. (2024, January 31). CNIL (France) SAN-2024-002 - DE PARTICULIER A PARTICULIER (PAP). Methodology v1.3. https://www.consentmark.com/precedent/cnil-san-2024-002[CNIL (France) SAN-2024-002 - DE PARTICULIER A PARTICULIER (PAP) - ConsentMark](https://www.consentmark.com/precedent/cnil-san-2024-002)CNIL (France) SAN-2024-002 - DE PARTICULIER A PARTICULIER (PAP) - ConsentMark, 2024-01-31, methodology v1.3, https://www.consentmark.com/precedent/cnil-san-2024-002