CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Examination of the case:
Paris, le
No./Ref.: MLD/DAU/CM211730
Case no. 20013084
(To be referenced in all correspondence)
Sir,
This is further to the exchanges that took place between the services of the French data protection authority (Commission nationale de l'informatique et des libertés « CNIL ») and the lawyer of within the framework of the examination of complaint, transmitted to the CNIL by the Norwegian data protection authority (« Datatylsinet ») pursuant to Article 56.1 of the General Data Protection Regulation (« GDPR »).
had lodged a complaint with his national personal data protection authority against the concerning the alleged transmission of one of his personal message (whose content is « We must secure the existence of our people and a future for white children ») by to a third party, the
The latter had requested your services by email dated April 6th, 2020 about the purposes and the legal basis of such transmission, without obtaining any answer.
Our exchanges lead me, in agreement with other European data protection authorities concerned by the processing of data of users of the website to proceed to the closure of this complaint.
Indeed, first of all, I take note that is not at the origin of the transmission of the message at stake to the
In this case, users of services, recipients of this message, have transmitted it directly to the personal address of the Tournament Director of the , who also turns out to be a volunteer moderator of . The latter has then transmitted again this message to the competent service of the , in his quality of Director, but not as a moderator, from his personal address. Therefore, tools made available to the moderators by have not been used, for obtaining, nor for transmitting the private message at stake.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
In any event, I do bring your attention on the necessity for [REDACTED] to implement appropriate technical and organisational measures, in order to ensure that its moderators do not share personal data obtained within their moderation with third parties, in accordance with Article 32 GDPR.
Furthermore, although data protection authorities are not competent to assess the lawfulness of the complainant's account lockout took by [REDACTED] further to the insulting messages pronounced by the latter, [REDACTED] had to inform him about the reasons leading to his exclusion from the service, as well as about the duration of such exclusion, at least when receiving the complainant's request for explanations. Therefore, I do invite you to provide such information to [REDACTED].
Yours Sincerely,
Marie-Laure DENIS