France: French Data Protection Authority imposed fine on Ubeeqo International

On 7 July 2022, the French Data Protection Authority (Commission Nationale de l'informatique et des Libertés - CNIL) imposed a fine amounting to EUR 175 000 on Ubeeqo International, a french company specialising in short-term car rental, for having infringed the privacy rights of its customers. The CNIL stated that Ubeeqo collected the geolocation data of customers and stored it for three years after the end of the vehicle rental. Furthermore, CNIL found that the company failed to comply with the obligation to ensure data minimization outlined in Article 5.1 of the General Data Protection Regulation (GDPR), define and respect a proportionate data retention period and inform individuals about the processing of their geolocation data as required in Article 12 of the GDPR.