The Chair
Registered letter with A.R.
A.R. no.: 2C 127 845 4657 5
Investigation of the case: Paris, on the 20th March 2019
Our Ref.: MLD/MJN/CLP191004
Referral no. 18019335
(To be quoted in all correspondence)
Dear Chief Executive,
I refer to the email exchange between my department and
your Data Protection Officer (hereinafter “DPO”), as part of the investigation into
complaint, which was transferred to us by the supervisory authority of Berlin (Germany),
pursuant to Article 56.1 of the General Data Protection Regulation (GDPR).
had lodged a complaint with this supervisory authority against
due to difficulties encountered in exercising his right to object to receiving marketing by email, on the
one hand, and concerning the information given on the product order form on the
website, on the other hand.
Following the exchanges between the CNIL and DPO, I inform you of the
following decision.
This decision was taken in agreement with the supervisory authorities concerned by the
marketing processing carried out by in the different European Union countries.
Chiefly, as regards the exercise of the claimant’s right to object, I note that
request to unsubscribe was taken into account by your department on his first request dated 2 June
2018 through the unsubscribe link and that he has not received any emails from
since 8 June 2018.
In this respect, your DPO specifies that continued to receive emails from 2 to 8
June 2018 due to the 72-hour delay that can occur between a request to object being made and the
consideration this latter, this period being indicated in the email of acknowledgment of receipt that
. However, in this case, the request had been made on a Saturday and Monday 4
June was a bank holiday in France.
Furthermore, states that the claimant sent his written requests to
object dated 2, 3 and 5 June 2018 by using the “reply” feature on the marketing emails that he had
received. These messages were sent by the address , which
cannot be replied to. In this respect, your DPO specifies that this information will now clearly appear
in the body of marketing emails.
Moreover, I note that the company has set up a dedicated email address
to handle requests relating to personal data more efficiently since the entry
into force of the GDPR. In particular, this email address appears on your website, including in its
German version, in the “personal data” tab.
Lastly, your DPO specifies that “when requests are actually made to [your] client services,
these are quickly redirected to the Data Protection Officer, who processes these requests within one
month, except for in complex cases”.
Secondly, as regards the product order form on your website, I note that the indication of
customers’ date of birth is no longer mandatory when purchasing online, including on the website’s
German version. Indeed, the mandatory nature of a response is marked by an asterisk next to the field
in question, which is not the case for dates of birth.
Furthermore, according to the checks performed by my department, I also note that the order
form includes two boxes which clients must check in order to consent to receiving promotional offers
from , in one case, and from its partners in the other.
These two boxes are also present in the German version of the order form on the
website.
All of these elements lead me to close this complaint against your organisation.
The CNIL reserves the right, in the event of any new claim, to use all powers afforded to it by
the GDPR and by the Act of 6 January 1978 amended.
Yours faithfully,
Marie-Laure DENIS
Copy: , Data Protection Officer