French data protection agency Cnil has imposed a sanction of EUR 150,000 on Facebook for breaching personal data legislation, as part as co-ordinated investigation with other EU authorities in Belgium, the Netherlands, Spain and Germany.
During the inquiry, carried out over nearly two years, Cnil criticised Facebook for a range of infringements, issuing a formal notice on 26 January which required the company to comply with the French Data Protection Act within a period of three months. The regulator renewed the formal notice once at the request of Facebook, but received an unsatisfactory response to the failings highlighted during the investigation.
The fine, which was imposed to Facebook Inc and Facebook Ireland, is based on six specific infringements. The company proceeded to a massive compilation of personal data without appropriate consent, in order to display targeted advertising. It also unfairly tracked internet users on third-party websites via the “datr,” cookie, without their knowledge.
Linked to these two main failings, it neglected to inform users on how their personal data would be used, in particular at the point of registration. It also infringed rules on the collection of sensitive data, on the right to oppose cookies, and on the retention of IP addresses linked to user accounts.
