---
title: "Carrefour France fined EUR 2,250,000 (France, 2020)"
canonical: "https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11"
source: "https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756"
source_note: "Only the authority's decision is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Fine · France

# Carrefour France: EUR 2,250,000

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Authority:** Commission nationale de l'informatique et des libertés (CNIL)
- **Country:** France
- **Date:** Decision of 18 November 2020
- **Amount:** EUR 2,250,000, as imposed (not converted)
- **Appeal status:** Unknown
- **Provisions cited:** [Article 5(1)(e)](https://dposchool.com/gdpr/article/5#1-e), [Article 12](https://dposchool.com/gdpr/article/12), [Article 13](https://dposchool.com/gdpr/article/13), [Article 15](https://dposchool.com/gdpr/article/15), [Article 17](https://dposchool.com/gdpr/article/17), [Article 21](https://dposchool.com/gdpr/article/21), [Article 32](https://dposchool.com/gdpr/article/32), [Article 33](https://dposchool.com/gdpr/article/33)

## What the fine was for (summary, not the official text)

Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.

Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.

## Official source

- [Decision or announcement of the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756)

Checked against the official source on 28 October 2026.

Only the authority's decision is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Fines](https://dposchool.com/gdpr/fines) / Carrefour France

[All fines](https://dposchool.com/gdpr/fines)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents