Go to Wolters Kluwer VitalLaw.comGo to Wolters Kluwer VitalLaw.com
VitalLaw®
  • Find answers to your questions
  • Log in to access your subscriptions
In depth. On point.
In depth. On point.
  • Home
  • Legal Directory
  • Home
  • Legal Directory
In depth. On point.
  • Articles
    • Articles
  • Organizations
    • Organizations
    • ‘Clock Ticking’ on Renewal of Cyber Threat Info-Sharing Law, Sen. Peters Warns
    • Deal to Wrest TikTok’s U.S. Business From Chinese Control Imminent, White House Says
    • Education Department OIG Will Probe DOGE Handling of Student Loan Data
    • Massachusetts Bill Would Allow Businesses to Sign up for Do-Not-Call List
    • Massachusetts Lawmakers Set to Review Internet Privacy Bill
    • New Zealand Privacy Amendments Approved, Await Royal Assent
    • Privacy Authorities From Multiple Jurisdictions Announce Cooperation Agreements
    • Recommendations on Inactive Account Deletions Issued in France
    • Use of AI to Write Privacy Complaints Discouraged by Dutch DPA
  • Articles
    • Articles
  • Organizations
    • Organizations

    Cybersecurity Policy Report, Recommendations on Inactive Account Deletions Issued in France, (Sep 22, 2025)

    By Tony Foley

    Professionals in the audiovisual and video game sectors must be aware of the rules to follow when managing inactive accounts while respecting user rights, according to guidance released by the French data protection authority, the Commission national ...

    By Tony Foley

    Professionals in the audiovisual and video game sectors must be aware of the rules to follow when managing inactive accounts while respecting user rights, according to guidance released by the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL).

    In a Sept. 18 press release, CNIL pointed out that the European Union’s General Data Protection Regulation (GDPR) established the principle that retention of personal data must be limited in line with the objective pursued, regardless of the medium used, and that organizations may not retain personal data without defining a precise retention period or the criteria for determining such a period.

    In the case of audiovisual content and video games, CNIL said professionals must provide uninterrupted access to users purchasing digital content, as required under consumer protection law. This often takes place through a personal account serving as a video library, allowing users to access their content. Professionals may retain certain data to enable this access, even if an account has been inactive for more than two years. However, CNIL said, the retention may only concern data strictly necessary to allow users to access their digital content, including data directly linked to their account such as e-mail, first name, last name, or pseudonym used, as well as saves made between games.

    CNIL concluded that organizations must ensure that they disclose the retention period as well as the different retention phases (including retention in an active database, followed by archiving) in a precise, clear, and transparent manner. It recommended that organizations implement appropriate technical and organizational measures while preserving users’ rights to the content, adding that after a two-year period of inactivity, organizations should put measures in place to deactivate an account, while keeping the associated information in an archive database and allowing subsequent reactivations of accounts on request.

    News: InternationalLegislation DataSecurity DataPrivacy GDPR

    © 2026 CCH Incorporated and its affiliates and licensors. All rights reserved.

    • Manage Cookie Preferences
    • Privacy Statement
    • Terms of Use