I see what you say in old recommendation but a recommendation is just a baseline you can change if you justify it. The new version seems to be in line with what

I see what you say in old recommendation but a recommendation is just a baseline you can change if you justify it. The new version seems to be in line with what you want : https://www.cnil.fr/sites/default/files/atoms/files/draft_recommendation_-_passwords_and_other_unshared_secrets_version_for_public_consultation.pdf https://www.cnil.fr/sites/default/files/atoms/files/draft_re... For Fidzup there was no monetary sanction. Investor have just walk away when they learned there was an inquiry. All sanction are published : https://www.cnil.fr/fr/thematique/cnil/sanctions https://www.cnil.fr/fr/thematique/cnil/sanctions I don't find anything crazy.