France: Closed Investigation by CNIL into Lusha Systems over GDPR Applicability

On 20 December 2022, the Data Protection Agency (CNIL) closed its investigation into Lusha Systems, Inc. (Lusha). The CNIL opened the investigation to assess whether Lusha's data processing complies with the General Data Protection Regulation (GDPR) and the Data Protection Act following several complaints. The CNIL found that Lusha does not have any establishment in the European Union (EU) and Lusha's web extension does not offer any goods or services to the data subjects. The CNIL also found that Lusha does not monitor the relevant data subjects. Therefore, the CNIL found no basis upon which to issue a sanction as the company is not subject to GDPR.