Listen
to
this
post
On
March
28,
2023,
the
French
Data
Protection
Authority
(the
“CNIL”
or
“French
DPA”)
announced
a
€125,000
fine
on
the
e-scooter
rental
company
Cityscoot
for
breaching
EU
and
French
data
protection
rules,
in
particular
in
the
context
of
geolocation
and
use
of
Google
reCAPTCHA.
The
fine
was
imposed
on
March
16,
2023.
The
fine
comes
as
part
of
the
CNIL’s
efforts
to
prioritize
investigation
and
enforcement
in
areas
related
to
French
citizens’
everyday
lives.
In
its
investigation,
the
CNIL
found
that
Cityscoot
collected
the
geolocation
of
rented
e-scooters
every
30
seconds
and
kept
a
record
of
this
information.
The
French
DPA
determined
that
in
doing
so,
Cityscoot
breached
the
obligation
of
data
minimization
under
Article
5
of
the
EU
General
Data
Protection
Regulation
(“GDPR”),
as
this
type
of
processing
is
highly
intrusive
and
the
service
could
be
provided
without
collecting
its
users’
geolocation
on
an
almost
permanent
basis.
The
CNIL
also
addressed
Cityscoot’s
use
of
Google’s
reCAPTCHA
when
creating
an
account,
logging
in
or
recovering
a
password.
The
French
DPA
determined
that
this
mechanism
works
by
collecting
hardware
and
software
information
from
the
data
subject’s
device
and
sharing
it
with
Google
for
analysis,
and
that
Cityscoot
failed
to
obtain
the
required
consent
of
the
data
subject
to
this
under
Article
82
of
the
French
Data
Protection
Act.
Finally,
the
French
DPA
investigated
Cityscoot’s
data
processing
agreements,
finding
that
three
of
them
did
not
contain
all
of
the
information
required
under
Article
28
of
the
GDPR.
Read
the
decision
(in
French)
and
the
press
release
(in
English
and
French).
About Author
