CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERT�S
The President
Examination of the case: Paris, on
2 7 JAN. 2020
Our Ref.: MLD/KKR/XD/DAU/CM193696
Case no. 19006478
(to be referenced in all correspondence)
Dear Mr. Director General,
This is further to the exchanges that took place between the CNIL's services and the Data
Protection Officer of in the framework of the examination of the complaint
lodged by , which has been transmitted to the CNIL by the Spanish data
protection authority ("Agencia Espanola de Proteccion de Datos ") according to the provisions of
Article 5 6 . 1 of the General Data Protection Regulation (GDPR).
had lodged a complaint with his national data protection authority against
which would have not granted his request to object to receive direct
marketing as well as his request for account deletion.
These exchanges lead me, in agreement with the other European data protection authorities
concerned by the direct marketing and customers' account management processing, to issue
reprimands to you in accordance with the provisions of Article 58.2.b} of the GDPR.
Indeed, your services have not informed about the effective deletion of
his data.
Yet, in accordance with the provisions of Article 1 2 . 3 GDPR, the data controller is required to
reply to the individual who made a request pursuant to Articles 1 5 to 22 GDPR, indicating the action
taken further to his or her request without undue delay "and in any event within one month of receipt
of the request".
Therefore, I hereby issue a reprimands to you on the need to respond to individuals making a
request for the exercise of the rights within the legal time limit of one month, which may be extended
by two further months where necessary, in particular in case of complexity of the request.
--------------- R E P U B L I Q U E FRAN<;AISE---------------
3 P l a c e de Fontenoy, TSA 8 0 7 1 5 - 7 5 3 3 4 P A R I S C E D E X 07 - 01 53 73 22 22 - w w w . c n i l . f r
I
Les donnees personnel/es necessaires a l'accomplissement des missions de la CNIL sont troltees dans des fichiers destines a son usage exclusif.
Les personnes concernees peuvent exercer leurs droits lnformatique et tibertes en s'adressant au delegue a la protection des donnees (DPO) de la CNIL
via un formulaire en ligne ou par courrier postal. Pour en savoir plus: www.cnil.fr/donnees-personnelles.
Moreover, you indicate that the unsubscribe link at the bottom of your direct marketing emails
refers to the page "My communications" of the concerned customer account. As a result, prospects
who do not have a customer account are unable to unsubscribe through this unsubscribe link.
Therefore, I invite you to allow to unsubscribe directly following a simple click on this link, without
referring to the concerned customer account.
In view of the information provided, however, I note that 's customer
account has been deleted a few days after 20 December 2 0 1 8 and that the data concerning him have
been erased from your direct marketing databases on 22 March 2 0 1 9 .
I also take note of the malfunction on your subsidiary's infrastructure which led to a lack of
synchronisation between your direct marketing database and the tool used to send
emails to your members and thus explains the delay for taking into account 's
request to object.
Furthermore, I note that your services only request a copy of an identity document in the event
of reasonable doubts concerning the identity of the applicant, in accordance with the provisions of
Article 1 2 . 6 GDPR. In this case, since 's account was already deleted when he
objected on January 2 0 1 9 , your services requested such additional information in order to avoid any
attempt of fraud or identity theft.
The CNIL reserves the right, in case of new claims, to use all of the powers conferred to it
under the GDPR and the law of 6 January 1 9 7 8 as amended.
Yours Sincerely,
This decision may be appealed before the French State Council within a period of two months
following its notification.