News

🏠 Real Estate & Personal Data: €400,000 Fine
📅 CNIL Decision – May 28, 2019 (Ref: 2019-995)
🔍 A security breach + excessive data retention = double GDPR violation

📌 Context:
In 2019, a company specialized in rental management was fined €400,000 for two major GDPR breaches:

🔐 1. Inadequate security (Art. 32 GDPR)
👉 A technical flaw allowed access to 290,000 confidential documents simply by modifying the URL.
💥 Result: Unauthorized access to ID cards, bank details, divorce judgments, CAF attestations, etc.
⚠️ No access control, no filtering, and no emergency measures taken after the breach was discovered.
👥 29,440 people affected

📁 2. Excessive data retention (Art. 5-1.e GDPR)
⏳ The company retained all supporting documents for 6 years, even for unsuccessful applicants.

💸 Aggravating factors:
• No authentication on the online portal
• Lack of responsiveness despite being alerted
• High sensitivity of the data exposed
• No secure archiving safeguards