French Data Protection Authority (CNIL)-DISCORD INC. (11/10/2022)

During its investigation, the DPA found that the company had failed to establish and also comply with a data retention period appropriate to the purpose of the processing. For example, there were over two million accounts within the DISCORD database of French users who had not used their account for more than three years and approximately 50,000 accounts that had not been used for more than five years.

Further, the DPA noted that the company did not have complete information regarding retention periods.

Also, the DPA found that the company had failed to ensure data protection by default, contrary to the obligation under Art. 25 (2) GDPR.
Thus, it was possible for user data to be transmitted even after the communication application was closed.

The DPA also found that the company had failed to sufficiently ensure the security of personal data by accepting insecure passwords from users.
The company accepted user passwords that consisted of six characters containing only letters and numbers.

Finally, the DPA found that the company had failed to conduct a data protection impact assessment.