CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The President
Mrs. President
74 RUE DE LA FEDERATION
75015 - PARIS
Examination of the case:
Paris, on
03 JUIL. 2020
Our Ref.: MLD/KKR/SGE/VEI/CM201945
Case n°19010704
(to be referenced in all correspondence)
Dear Mrs. President,
This is further to the exchanges that took place between the CNIL's services and the Data Protection Officer (DPO) of [REDACTED] in the context of the examination of a complaint lodged by [REDACTED] transmitted to us by the Danish data protection authority (Datatilsynet), according to Article 56.1 of the General Data Protection Regulation (GDPR).
[REDACTED] had lodged a complaint with his national data protection authority against [REDACTED] which didn't grant his access request.
The breaches identified through the exchanges between the CNIL and the DPO of [REDACTED] lead me, in agreement with the other European data protection authorities concerned by its processings, to issue reprimands to [REDACTED] in accordance with the provisions of Article 58.2.b) GDPR.
Indeed, in accordance with Articles 12 and 24 GDPR, [REDACTED] shall implement appropriate technical and organisational measures to facilitate the exercise of rights conferred on data subjects and to ensure that such requests for the exercise of rights are responded to within the time limit set by the GDPR.
However, the examination of this complaint has pointed out several malfunctions within your services.
In this present case, in order to explain the absence of response to [REDACTED] request, your DPO told the CNIL that the reference to a "letter for your data controller" in the complainant's request didn't allow your services to identify the right of access request, since the letter didn't mention key words, such as "GDPR, CNIL, data protection, personal data..."
Your DPO added that the right of access request was written in English, a language that is not professionally mastered by the team in charge of qualifying the mail. Nonetheless, the mail attached to the request was written in French and mentioned specifically that the request was intended "for your data controller".
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
It appears from those explanations that the implemented measures didn't allow your teams to process data protection requests (identify the relevant requests, respect the deadlines, respond to requests...) and to ensure a simple and effective exercise of the rights of data subjects.
For an international company, offering benefits, services and products worldwide, the implementation of measures in order to deal with English requests seems to be a reasonable expectation, notably towards data subjects concerned by the processing.
Finally, I note that, request initiated on the 10th of December 2018, has been granted by on the 2nd of July, 2019. To that extent, I remind you that according to Article 12 GDPR, even though you decide to extend the deadline for a response by two months to take into account the complexity of the request, you still have to reply to the data subject within a period of one month in order to inform that person of the extension and explain the reasons for it.
In closing, I would like to point out that the CNIL reserves the right, in case of new complaints, to use all the powers conferred to it under the law of January 6th, 1978 as amended, and the GDPR.
Yours Sincerely,
This decision may be appealed before the French State Council within a period of two months following its notification.