CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Examination of the case:
Paris, on January 18th, 2019
Our Ref.: IFP/XD/DAU/CM184083
Case no. 18019404
(to be referenced in all correspondence)
Dear Mr. Director General,
This is further to the exchanges that took place between the CNIL's services and the Data Protection Officer (hereinafter "DPO") in the framework of the examination of the complaint lodged by which has been transmitted to us by the Polish data protection authority according to provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
had lodged a complaint with her national data protection authority against which would have not granted her request for erasure of her data recorded within the loyalty program
Further to the exchanges between the CNIL and the DPO of and in agreement with other European data protection authorities concerned by the processing for customer retention, I have decided to draw your attention to the breaches found during the examination of this complaint, and to reprimand you for lack of compliance with the law on the following points.
I note that the data concerning have been well deleted by without her having to provide any copy of an identity card since the exchanges between the latter and your services allowed to remove any doubt as to her identity.
Nonetheless, this complaint has pointed out that has continued, after May 25th, 2018, to require individuals, regardless of their country of residence, to systematically provide a copy on an identity document for exercising their rights recognized by the GDPR.
I want first to outline that this practice does not, in view of its systematic nature, comply with the texts.
Admittedly, in its version prior to August 1st, 2018, Article 92 of the French Decree no. 2005-1309 implementing the Law of January 6th, 1978 required the production of such title.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
But from May 25th, 2018, the European regulation is of direct application across all Member States of the European Union. It has in France a higher legal status than the decree no. 2005-1309.
Therefore, without waiting for the modification of this French decree, [REDACTED] should have applied the provisions of the GDPR, in particular concerning the exercise of individuals' rights, over all European territory.
Thus, throughout the exercise of the rights, it is for the data controller to ensure that the individual making the request is the data subject.
In case of reasonable doubts, he can ask to this one to prove her identity (Article 12.6 of the GDPR). Yet, such request cannot lead her to provide to the data controller more data than necessary, in application of the data minimisation principle, and the requested materials or documents have to be relevant and proportionate in light of the objective pursued.
The level of verification to be carried out is depending on the nature of the request, sensibility of the communicated information and the context within which the request is being made. For illustrative purposes, it is disproportionate to require a copy of an identity document in the event where the claimant made his request within an area where he is already authenticated. An identity document can be requested if there is a suspicion of identity theft or of account piracy for instance.
I would specifically like to draw your attention on the different national laws regulating the collection and the processing of the identification national number that is likely to appear on identity documents of data subjects.
In this context, [REDACTED] should not have requested [REDACTED] to provide a copy of an identity document as soon as she submitted her request for erasure of her data, without checking if there was a reasonable doubt as to her identity nor if this document was relevant and proportionate.
Second, I draw your attention to the fact that the data controller may in principle store the information needed for the exercise of individuals' rights, in particular documents allowing to remove a reasonable doubt, only during the period enabling to answer those requests.
Nonetheless, it can appear legitimate to store some of the data that have an interest in case of litigation during a longer period. In that case, these data have to be subject to an "intermediary" archiving on a support separate from the active base with a restricted access to authorized persons.
In any event, these data have to be definitely erased at the end of legal limitation applicable periods.
For more information on this point, I invite you to check the practical fact sheet entitled "Limit data retention" available on CNIL's website at the following URL address: http://www.cnil.fr/fr/limiter-la-conservation-des-donnees.
Finally, I also acknowledge that the entry into force of the GDPR on May 25th, 2018 as well as the amendments introduced in the French data protection law since June, 2018 are leading [REDACTED] SA to proceed to "significant adaptations inside the [REDACTED], concerning the exercise of data subjects' rights.
The CNIL reserves the right, in case of new complaints, to use all of the powers conferred to it under the law of January 6th, 1978 as amended and the GDPR.
Yours Sincerely,
Isabelle FALQUE-PIERROTIN
This decision may be appealed before the French State Council within a period of two months following its notification.