¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
CNIL
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The President
Registered letter with AR
N°:
Paris, the 31 MARS 2021
Our Ref.: MLD/CHT/RAL201030
Case n°19016963
(to be referenced in all correspondence)
Dear M. President,
I am writing further to the complaint of , transmitted to the CNIL by the Spanish Data Protection Authority ("Agencia Española de Proteccion de Datos") pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
filed a complaint with her national data protection authority against which belongs to the and is domiciled in France, regarding a personal data breach committed during an order on the website on 6 November 2018. This breach results from a fraudulent intrusion on the e-commerce platform installed on this website between 0:11 am on 3 November 2018 and 12:52 pm on 8 November 2018.
The exchanges that have taken place between the CNIL departments and the DPO Office in connection with the investigation of this complaint lead me, in agreement with the other European data protection authorities concerned by this personal data breach, to remind of its obligations regarding the following points, in accordance with the provisions of Article 58.2.b) of the GDPR.
In the event of a personal data breach, is required to notify the relevant supervisory authority of the breach in question as soon as possible and, if possible, 72 hours after becoming aware thereof, unless the breach in question is unlikely to result in a risk to the rights and freedoms of individuals.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
In this case, the UK and Dutch supervisory authorities were notified of the breach on 16 November 2018. Your services have indicated to the Commission that this choice of notifications lies in the fact that, on the one hand, the Netherlands is where registered office is located and is designated in the general terms of use of the website as the place of jurisdiction and that, on the other, England is this website's main country of operation.
However, your data protection officer has also confirmed to us that is the data controller implicated in this case.
Therefore, the notification should have been made to the French data protection authority, the CNIL, pursuant to Article 33.1 of the GDPR.
I also note the measures taken to avoid the repetition of such events.
in fact proves that the individuals concerned were notified by an email from sent on 16 November 2018 to each of the individuals identified as victims of the breach, as well as by a message on its website. Similarly, your services report security audits conducted on the platform and a set of measures taken regarding its architecture, as well as PCI SAQ 3.2 rev. 1.1 certification.
Finally, I would like to point out that this decision, which closes the examination of complaint, does not preclude the CNIL from using, in the event of new complaints, all the other powers conferred to it under the law of January 6th, 1978 as amended and the GDPR.
Yours sincerely,
Marie-Laure DENIS
Copy to Data Protection Officer
This decision may be appealed before the French State Council within a period of two months following its notification.