CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The President
Letter with acknowledgment of receipt
No.2C 137 409 1452 0
Paris, on April 13th, 2021
To be referenced in all correspondence:
No./Ref. : MLD/DAU/MDM211007
Formal notice no. MED 2021-015 of April 13th, 2021
Cases no. 18019407 et 19008798
Dear Mr Chief Executive Officer,
Within the framework of a complaint from [REDACTED] (case no. 18019407), transmitted by the German data protection authority from the Land of Berlin in accordance with the provisions of Article 56.1 of the General Data Protection Regulation (GDPR) no. 2016/679 of April 27, 2016 and of a complaint received by the CNIL from [REDACTED] (case no. 19008798), there have been several exchanges between the CNIL and [REDACTED] since October 2018.
The complainants were notably requesting the erasure of the data concerning them posted on [REDACTED] and [REDACTED] underlined that he hasn't been informed properly about the processing of his data.
Further to your company's letter dated July 7th, 2020 and after having consulted our concerned counterparts, I inform you about the following decision.
[REDACTED], it is no less essential that sufficiently clear information about the processing of data concerning them carried out by your company is delivered.
The CNIL has thus invited you to review the information delivered to the artists listed on your website, notably by letter dated June 23rd, 2020, which reminded you that an individual information should be delivered to them pursuant to Article 14 GDPR.
By letter dated July 7th, 2020, your services have transmitted in response the « Confidentiality and Personal Data Protection Charter » and the « artist biography form », documents that are available on the website [REDACTED]
You furthermore assert that « the artist whose work is auctioned perfectly knows that the data relating to his work and its sale are and should be made public » and that pursuant to recital 62 GDPR, « it is not necessary to impose the obligation to provide information where the data subject already possesses the information ».
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
Nonetheless, although we do not challenge the fact that the artists are informed by the auction houses about how the data concerning them are being processed by those, I first note that these documents do not contain any information for artists whose data are thus indirectly being collected, that is through your company's contractual partners and in particular, auction houses.
Furthermore, it appears to me that you're still misunderstanding, despite already four letter from the CNIL on this topic, the information that should be provided to individuals about the processing of personal data concerning them.
Indeed, the information foreseen by Articles 13 and 14 GDPR must be specific to each processing carried out by each body. The purpose and the way auction house organising public auctions process data relating to artists differ from the purpose and the way processes these same data on its website
Therefore, as already indicated, the information delivered on the website cannot satisfy the transparency obligation provided for under Articles 12 to 14 GDPR in order to inform individuals about conditions for processing data coming from public auctions.
As a result, pursuant to Article 20 of French law no. 78-17 of January 6, 1978 as amended and to Article 58.2.d) of the general data protection regulation, and in agreement with other data protection authorities concerned by the processing, the company established at is formally noticed to, within one (1) month from notification of this decision, and subject to the measures that might have already been adopted, ensure that the artists listed on the website are being informed individually of such listing, in accordance with the requirements of Article 14 GDPR, either by providing itself this information or by delegating this task to its contractual patners.
After the expiry of that period, in case where the company has complied with this formal notice, I will address it a letter for informing it that this formal notice procedure is closed.
On the contrary, in case where in view of all elements brought to the Commission, it is observed that the company has not complied with this formal notice, I could seize CNIL's restricted committee in order for one or several of the measures set out under Article 20 and subsequent of French law of January 6th, 1978 as amended to be pronounced.
The services of the Commission ( )
) remain at your disposal for further information.
You can lodge an appeal against this decision of formal notice before the French Council of State within two months of its notification.
Yours Sincerely,
Marie-Laure DENIS