The Cnil has imposed a fine of 250,000 euros on the company Infogreffe for having kept too long and insecurely the personal data of users of its website, according to a deliberation made public on Tuesday.
The National Commission for Computing and Liberties had received a complaint from an Infogreffe user denouncing the ease of access by third parties to his password.
She then noted “several shortcomings concerning the processing of the personal data of users of the service”, which makes it possible to consult legal information on companies for a fee and to order documents certified by the registries of the commercial courts, explains. her in a statement.
In question, the retention of banking information, surnames, first names, addresses, etc. beyond the 36 months provided by the site for inactive accounts, which concerned a quarter of users, and the absence of an automatic anonymization procedure.
Not enough measures
Also in the viewfinder of the Cnil, the absence of “sufficient measures to guarantee the security of the data of the members and users” of Infogreffe.
In particular, it was “impossible for the 3.7 million accounts to enter a secure password due to the limitation of their size”, notes the Cnil.
In addition, Infogreffe “transmitted in plain text, by e-mail, the non-temporary passwords allowing access to the accounts” and kept them, always in plain text, in its database.
Created in 1986 by the clerks of the commercial courts, the GIE (economic interest group) Infogreffe for its part launched, since the control, “a purge of accounts inactive for more than 36 months” and “implemented certain actions “In terms of security, according to the Cnil.
This sanction was “taken in cooperation with the other European authorities concerned”, the site having user accounts in all EU member countries.
It “is likely to be the subject of an appeal before the Council of State” within two months, it is specified in the deliberation.