Data scraping: French SA fines KASPR €200,000
Data scraping: French SA fines KASPR €200,000
January 2025
The French Supervisory Authority (CNIL) has fined KASPR €200,000 for a number of breaches and has ordered the company to cease collecting the data of persons who chose to limit the visibility of their contact details, and delete the data collected in this way.
KASPR markets an extension for the Chrome browser that enables paying customers to obtain the professional contact details of people whose profiles they visit on the LinkedIn social network. To do this, the company builds a database of contact details from LinkedIn and other websites such as domain name registries. The contact details thus collected generally enable the company's customers to contact the target persons, for example for commercial prospecting, recruitment or identity verification. KASPR's database contains about 160 million contacts.
CNIL said that If it is impossible to distinguish the data whose visibility has been limited, the company will have to inform the persons concerned, within 3 months, of the processing of their data and of the possibility of objecting to it, and to use their data solely for this purpose.
In addition, CNIL ordered the company to stop the automatic renewal of the storage of personal data of target persons; inform the people whose data is collected in a language they understand; and respond to requests for access from individuals, providing all available information on the sources of data collection.
The CNIL found several breaches of the GDPR:
- Failure to comply with the obligation to have a legal basis (Article 6 of the GDPR)
- Failure to comply with the obligation to define and respect a data retention period proportionate to the purpose of the processing (Article 5-1-e of the GDPR)
- Failure to comply with the obligation to provide transparency and information to individuals (Articles 12 and 14 of the GDPR)
- Failure to respect the right of access of individuals (Article 15 of the GDPR)
For more details on this case visit https://www.cnil.fr/en/data-scraping-kaspr-fined-eu240000