Precedent corpus / CNIL (France)
DE PARTICULIER A PARTICULIER (PAP)
CNIL (France) case SAN-2024-002, decided . EUR 100k.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
What the regulator decided
PAP retained user account data and inactive-user data beyond the period necessary for the purposes for which they were processed, breaching Article 5(1)(e) GDPR; failed to provide complete information to data subjects in breach of Article 13; did not frame its relationship with a processor with the contractual safeguards required by Article 28; and stored credentials without an appropriately strong hashing function and in plain text in some logs, breaching Article 32.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049128617Archived snapshot
Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.
https://web.archive.org/web/20250331054141/https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049128617ConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
Real-estate-classifieds publisher (pap.fr). Cite when the scanner narrative needs the precedent that inactive-user retention beyond a documented period is itself an Article 5(1)(e) breach, and that weak credential storage triggers Article 32 even when no external compromise occurred.
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-cnil-san-2024-002,
author = {{ConsentMark}},
year = {2024},
title = {CNIL (France) SAN-2024-002 - DE PARTICULIER A PARTICULIER (PAP)},
howpublished = {\url{https://www.consentmark.com/precedent/cnil-san-2024-002}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2024, January 31). CNIL (France) SAN-2024-002 - DE PARTICULIER A PARTICULIER (PAP). Methodology v7.8.1. https://www.consentmark.com/precedent/cnil-san-2024-002[CNIL (France) SAN-2024-002 - DE PARTICULIER A PARTICULIER (PAP) - ConsentMark](https://www.consentmark.com/precedent/cnil-san-2024-002)CNIL (France) SAN-2024-002 - DE PARTICULIER A PARTICULIER (PAP) - ConsentMark, 2024-01-31, methodology v7.8.1, https://www.consentmark.com/precedent/cnil-san-2024-002