Fine · France
Carrefour France: EUR 2,250,000
- Authority
- Commission nationale de l'informatique et des libertés (CNIL)
- Country
- France
- Date
- Decision of 18 November 2020
- Amount
- EUR 2,250,000, as imposed (not converted)
- Appeal status
- Unknown
- Provisions cited
- Article 5(1)(e), Article 12, Article 13, Article 15, Article 17, Article 21, Article 32, Article 33
What the fine was for (summary, not the official text)
Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.
Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb_aar_2020_final_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.
Checked against the official source on 28 October 2026.
Only the authority's decision is authoritative. This is reference material, not legal advice.