In January 2024, the French data protection authority (CNIL) fined PAP, the operator of the pap.fr real estate website, €100,000 for failing to limit data retention and maintain adequate security, highlighting that keeping personal data too long can trigger severe consequences.
What Happened?
CNIL investigations in March–April 2022 revealed PAP had retained users’ data (names, email addresses, phone numbers, and advert content) for up to ten years.
Such extended retention lacked legal justification under GDPR or the French Consumer Code.
PAP’s privacy notice also failed to clearly inform users of retention periods, categories of processors, and data subjects’ rights.
Additionally, deficiencies were identified in data security measures, failing to comply with Articles 5(1)(e), 13, and 32 GDPR.
Why Was This a Problem?
The Legal violation of limited retention principle: GDPR Article 5(1)(e) requires personal data to be stored no longer than necessary. PAP’s default 10-year retention period was excessive and unjustified.
Transparency failures: Under Articles 13 and 14, data subjects must be informed about retention duration, processing purposes, and processors. PAP’s policy was vague and incomplete.
What Does It Mean for Your Organisation?
This case serves as a sharp reminder that GDPR’s retention principle isn’t optional, it’s a core obligation. Holding data without a legally valid justification can lead to enforcement action, even without a data breach. Transparency and security are expected to go hand in hand.
Retention policies are a litmus test: they expose whether your organisation truly understands its privacy and compliance obligations, or if it’s leaning on convenient defaults that breach rights.
To Avoid Similar Pitfalls, Organisations Must:
Define retention periods clearly and justifiably: Map the lifecycle of each category of personal data and establish specific deletion schedules aligned with legal, contractual, or operational requirements.
Reflect retention in privacy notices: Ensure privacy policies accurately describe how long data is kept, why, and which third parties process it.
Automate deletion triggers: Use systems that automatically flag or delete data once its retention period expires.
Secure long–held data robustly: Implement additional technical safeguards, such as encryption and strict access controls, where legacy data is stored.
Review retention and transparency annually: Periodically audit practices to account for evolving laws, business needs, and data subjects’ expectations.
The takeaway?
Data Retention is not a technical detail, it’s central to GDPR accountability and data minimisation. As the PAP example shows, redundant archiving can lead to regulatory backlash even in the absence of overt breaches.
Organisations must prune data routinely, automate lifecycles where feasible, and document decisions thoroughly. If your retention policy hasn’t been reviewed in the last 12 months, or if systems allow indefinite storage by default, it’s time to take action.
Tales from the coalface
Each month, we examine Data Protection issues encountered by our clients. This month, we focus on website privacy notices, and why they often fall short, and how getting them wrong can be risky.
The Most Overlooked Page on Your Website
Every organisation has one, but not all are fit for purpose. Privacy notices are a key transparency requirement under the GDPR. They’re meant to inform users about what data is collected, why, for how long, and with whom it's shared. But too often, we see organisations treat privacy notices as legal wallpaper, generic, outdated, or buried in footer links no one reads.
This complacency can carry significant compliance and reputational risks. A poorly constructed privacy notice doesn’t just confuse users, it signals to regulators that your organisation may not understand, or worse, may be ignoring its data protection obligations.
What’s the risk of a weak or vague privacy notice?
Regulatory non-compliance: Article 13 and 14 of the GDPR require clear, concise, and accessible information. Generic or incomplete notices fail to meet this standard.
Increased risk of complaints: Vague notices invite suspicion. Data subjects are more likely to raise concerns or exercise their rights if your processing seems opaque.
Erosion of trust: Customers and clients increasingly expect transparency. If your notice doesn’t explain how data is used or shared, they may assume the worst.
Compounded liability: In the event of an investigation or breach, a deficient privacy notice can suggest deeper compliance gaps, potentially triggering fines or orders to change your practices.
Why it happens:
Most privacy notices are written once, often hurriedly during a website launch, and then left untouched. They become static documents in a dynamic environment.
Off-the-shelf templates are used without tailoring.
Notices aren’t updated when processing activities change (e.g., adding new tracking tools, CRMs, or third-party integrations).
Legal language takes precedence over user understanding.
Data processing is siloed across departments, making it hard to map accurately.
No one is formally responsible for keeping the notice up to date.
How to fix it:
Map your data flows: Understand exactly what personal data you collect, how it's used, who processes it, and for how long. This is your foundation.
Tailor your notice: Avoid copy-paste language. Your privacy notice should reflect your actual practices, not someone else’s.
Use plain English: Aim for clarity over legalese. If users can’t understand it, it doesn’t meet GDPR standards.
Make it accessible: Link to the notice prominently, preferably in the Cookie Baner and the website footer, not buried in menus or in tiny fonts.
Assign ownership: Designate someone, typically in compliance, legal, or marketing, to own the review and update process. Revisit it at least annually, or whenever your processing changes.
A good privacy notice is a legal obligation and a core part of your user experience. It should be accurate, readable, and regularly reviewed.
The privacy notice is your organisation’s front door to transparency. If it’s unclear, outdated, or irrelevant, users and regulators alike will question what lies behind it. Treat it as a living document, not a static checkbox, and you’ll not only reduce legal risk but build trust along the way.
If your organisation needs help with data protection compliance, such as reviewing access rights, updating policies, or conducting a system audit, Ambit Compliance can assist. Do not hesitate to contact us at info@ambitcompliance.ie and check further about us on our website https://www.ambitcompliance.ie/.
Contributors to this blog: Gillian Traynor, Dwayne Morgan, and Facundo Heredia.
