Numéro 17 | novembre 2026, semaine 1

General Motors to pay $220M over selling drivers’ private data

Compétence

États-Unis

Nom légal du contrevenant

General Motors

Domicile de l'infracteur

États-Unis

Infraction présumée

Data protection violation

Action d'exécution

$220 million fine

Statut de l'affaire

Mesure administrative

General Motors (GM) has agreed to pay $220 million to settle a lawsuit brought by 36 US states over the sale of drivers’ personal data.

The lawsuit accused the carmaker of collecting and sharing customers’ location and driving information with data brokers, who then sold it to insurance companies. The data was reportedly used to influence how much drivers paid for insurance.

GM’s Smart Driver program operated from 2016 to 2024. Customers were encouraged to join, with the company claiming that tracking driving habits could help improve road safety.

Toutefois, les autorités ont indiqué que GM avait partagé ces informations avec des tiers sans en informer correctement les clients ni obtenir leur consentement.

Many drivers reportedly signed up at dealerships while buying their cars. Dealership employees were also given bonuses and incentives for enrolling customers in the program.

As part of the settlement, GM is required to obtain clear customer consent before collecting or sharing driving data. The company must also limit the amount of information it collects, improve data protection and provide better training for dealership staff.

Italy fines Notarial Council and Justice Ministry over data protection breaches

Compétence

Italie

Nom légal du contrevenant

Plusieurs entités

Domicile de l'infracteur

Italie

Infraction présumée

Violations du traitement des données

Action d'exécution

€15,000 fine; €20,000 fine

Statut de l'affaire

Mesure administrative

Italy’s Data Protection Authority has fined the National Council of Notaries (CNN) €15,000 and the Ministry of Justice €20,000 over the handling of personal data during the 2024 competition for 400 notary positions.

The investigation began after media reports claimed that the Council had published a document containing written exam results alongside unofficial comments and annotations about some candidates.

L’enquête a révélé qu’un membre de la commission d’examen avait transmis par erreur une liste des candidats admis à l’épreuve orale, incluant des commentaires non autorisés. Ce membre avait agi de manière indépendante, sans approbation de la commission ni du ministère de la Justice.

L’Autorité a également constaté que le ministère avait affiché les résultats de l’épreuve écrite, y compris les noms des candidats qui n’avaient pas été admis à l’épreuve orale, à l’entrée de ses locaux. La réglementation exige que seuls les candidats admis soient mentionnés et limite les lieux où les résultats peuvent être affichés.

Le Conseil national des notaires a également été trouvé avoir partagé la liste des candidats avec les notaires inscrits avant l'annonce officielle des résultats par le ministère. Il a brièvement publié une version contenant des notes non officielles qui différaient de la liste officielle du ministère.

The fines were issued under Orders No. 761 and 762, both dated October 7, 2026. As the violations had already expired, the authority decided not to impose any additional corrective measures on either administration.

Fnac Darty amendée de 7 M€ pour tracking illégal

Compétence

France

Nom légal du contrevenant

Fnac Darty

Domicile de l'infracteur

France

Infraction présumée

France’s Data Protection Act violation

Action d'exécution

Amende de 7 millions d'euros

Statut de l'affaire

Mesure administrative

France’s data protection authority (CNIL) has fined major European electronics retailer Fnac Darty a total of €7 million for tracking users through its mobile application without their consent.

The investigation began after a complaint from privacy organization None Of Your Business (NOYB). Following an audit in March 2024, the CNIL found that opening the app automatically sent user data to external servers, including device identifiers and browsing activity.

The data was used to provide personalized product recommendations and train the companies’ recommendation algorithms. However, users had not consented for tracking.

La CNIL a estimé que cette pratique enfreignait l’article 82 de la loi française sur la protection des données. L’autorité de contrôle a conclu que le suivi ne relevait d’aucune exception légale et nécessitait donc le consentement préalable des utilisateurs. En conséquence, Fnac Darty Participations et Services s’est vu infliger une amende de 6 millions d’euros, tandis que Fnac Direct a reçu une amende d’un million d’euros.

Lyft accepte de payer 1,8 million de dollars pour des violations des lois sur la vie privée en Californie

Compétence

États-Unis

Nom légal du contrevenant

Lyft

Domicile de l'infracteur

États-Unis

Infraction présumée

Privacy laws violation

Action d'exécution

$1.8 million penalty

Statut de l'affaire

Mesure administrative

American ridesharing company Lyft has agreed to pay $1.8 million in civil penalties to settle claims that it violated California privacy laws.

The settlement follows allegations that Lyft made it difficult for users to opt out of having their personal information sold or shared. Under the California Consumer Privacy Act (CCPA), companies must provide consumers with a clear and simple way to exercise this right.

According to the California Attorney General’s office, Lyft previously buried its opt-out option behind several links in its privacy policy. Users also had to log in again and provide additional personal information to complete the process.

The investigation found that the mechanism created unnecessary barriers for consumers trying to protect their privacy. Lyft had also been sharing personal information, including location data, to display targeted advertisements within its app since mid-2023.

In addition to the $1.8 million penalty, Lyft is required to introduce a clear opt-out option directly in its app and inform California users of their right to prevent the sale of personal information.

Major Canadian telecom provider fined $15M over “unlimited” data claims

Compétence

Canada

Nom légal du contrevenant

Rogers Communications

Domicile de l'infracteur

Canada

Infraction présumée

Misleading advertising

Action d'exécution

$15 million penalty

Statut de l'affaire

Mesure administrative

Major Canadian telecommunications and media company Rogers Communications has been ordered to pay a $15 million administrative penalty over misleading advertising of its “Infinite” wireless phone plans.

Canada’s Competition Bureau filed an application with the Competition Tribunal in December 2024, alleging that Rogers gave customers the false impression that its plans offered unlimited data.

However, the plans significantly reduce internet speeds once customers reach a certain data limit, meaning users may experience much slower service even though their data remains available.

The Tribunal also ordered Rogers to publish a corrective notice and reimburse the Competition Bureau for its legal fees.