French Data Protection Authority Issues Warning To Two Companies For Potential GDPR Violations

France's data protection authority published a formal warning to two French companies regarding their geolocation data collection and retention practices. The warning provides some clarity on the GDPR's consent and data retention standard.

In late July 2018, France's data protection authority, the Commission Nationale de L'informatique et des Libertés (CNIL), published a formal warning to two companies — Teemo, Inc. (Teemo) and Fidzup SAS (Fidzup) — that allegedly collected and retained geolocation data in violation of the EU's GDPR.² The CNIL did not impose any fines on the companies, but stated that Teemo and Fidzup may be subject to penalties if they fail to obtain valid consent from data subjects and set an appropriate retention period for geolocation data within three months.