The President
Paris, on May 11th, 2020
Our Ref.: MLD/KKR/SGE/DAU/CM201158
Cases no. 19012057
(to be referenced in all correspondence)
Dear Mr. President,
This is further to the exchanges which took place between CNIL's services and
's representatives in the context of the examination of 's complaint,
pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
lodged a complaint with the CNIL regarding the difficulties encountered with
to obtain the deletion of her personal data.
These exchanges lead me, in agreement with the other European data protection authorities
that are concerned by the processing of data of service’s customers, to issue reprimands to
on the following points, in accordance with the provisions of Article 58.2.b)
of the GDPR.
Indeed, has to ensure and be able to demonstrate that its customers’ data
are being processed lawfully, fairly and in a transparent manner in relation to them (Articles 5.1.a) and
5.2 GDPR). In addition, pursuant to Articles 17.1 and 21.1 GDPR, when a customer of
asks for the deletion of his or her personal data, the latter shall have the obligation to erase these
data without undue delay.
In this particular case, still had access to her account and to the data
relating to her order history, despite confirmation by s services of the deletion of
her account and of all her personal data by an email dated February 16th, 2019.
Yet, such confirmation should have been addressed to only after that
has ensured itself that her data have been effectively deleted.
By a first response letter to the CNIL dated September 25th, 2019, stated
that the deactivation of 's account, which took place though the day after her request (that
is on February 16th, 2019), was not effective when she tried to connect to her former account with her
ID due to a technical malfunction. It specified that it had resolved this technical malfunction
on September 17th, 2019 using a script that makes the deactivated accounts unavailable, unless
specifically required by its authorized personnel.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 – 75334 PARIS CEDEX 07 – 01 53 73 22 22 – www.cnil.fr
Les données personnelles nécessaires à l’accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s’adressant au délégué à la protection des données (DPO) de la CNIL via un
formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
However, as indicated by a second letter dated January 14th, 2020, s
investigations revealed that along with these measures, a member of the customer service had
previously taken the initiative to obfuscate the sole complainant's account ID for trying to solve her
difficulty. This initiative would have prevent the functioning of the script and overall, the deletion of
the complainant’s account.
I note that challenged once more by CNIL’s services, subsequently
restored ' account ID and restarted the script so that her account could effectively be
unavailable.
It stems from the above that has not been able to demonstrate the
effectiveness of the deletion of ’ data, despite a first confirmation to her and then a
second one to CNIL’s services.
Furthermore, I note that has indicated that it will proceed with the
definitive deletion of the complainant's data at the end of the applicable limitation periods and
retention obligations (in particular to respond to the risk of litigation or pursuant to Article L.123-22
of the French commercial code).
For all purposes, I thus draw ’ attention on the need to sort through
’ data in order to solely store, in intermediate archives with restricted access, data necessary
for the exercise of legal claims or for compliance with legal obligations (see, to that effect, the fact
sheet entitled “Limit data retention” available on CNIL’s website at the following URL:
https://www.cnil.fr/fr/limiter-la-conservation-des-donnees).
Yours Sincerely,
This decision may be appealed before the French State Council within a period of two months
following its notification.
2