CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The Chairwoman
Paris, - 9 AVR. 2021
Our Ref.: MLD/LCN/RAL211005
Ref. No 20019872
(to be quoted in all correspondence)
Dear Sir,
I am following up on the various exchanges that have taken place between the services of the Commission Nationale de l'Informatique et des Libertés ("CNIL" - French Data Protection Authority) and the Digital Protection Officer of as part of the investigation of complaint, transmitted to the CNIL by the Belgian Data Protection Authority ("DPA" - Belgian Data Protection Authority) pursuant to Article 56.1 of the General Data Protection Regulation ("GDPR").
had lodged a complaint with his national data protection authority against concerning difficulties in exercising his right to portability and his right to erasure.
The failures noted at the time of the exchanges between the CNIL and lead me, in agreement with the other European data protection authorities concerned by the processing implemented, to remind of its obligations, in accordance with the provisions of article 58.2.b) of the GDPR.
In this case, exercised his right to the portability and deletion of his data following the termination of his contract with These requests have not been answered.
has acknowledged that it had failed in its obligations by not responding to requests. It also stated that the data collected from customers, namely the telephone number and IP address, were not "elements giving rise to portability" on the one hand, and confirmed to us that the personal data concerning had been deleted, on the other hand.
However, I would remind you that Article 20 of the GDPR provides that, when certain conditions are met, "the data subject shall have the right to receive personal data concerning him or her, which he or she has provided to a controller in a structured, commonly used and machine-readable format".
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
Therefore, when [REDACTED] receives a request for data portability, it must provide the applicant with the data that he or she has communicated at the time of subscription, as well as the data generated by his or her activity, provided that these are processed in an automated manner and based on prior consent or on the performance of a contract.
Therefore, following his request, you should have transmitted to [REDACTED] all the personal data concerning him provided or generated in the context of the subscription with your services.
In this case, I understand from your reply that the data have been deleted in the meantime and that there is therefore no longer any reason to transmit them. The request for deletion is therefore no longer applicable.
In any case, and in a general way, you must inform the person of the outcome of his or her request within one month of receiving it (Article 12.3 of the GDPR), mentioning that he or she can lodge a complaint with the competent data protection authority and seek legal redress (Article 12.4 of the GDPR).
You will find a great deal of information on this subject on the CNIL website, in particular on the “Compliance tools” page, which can be accessed via the following URL https://www.cnil.fr/fr/les-outils-de-la-conformite.
Finally, I would like to point out that this decision, which closes the investigation of [REDACTED] complaint, does not exclude the CNIL from making use, particularly in the event of new complaints, of all the other powers attributed to it by the RGPD and by the amended Act of 6 January 1978.
Yours sincerely,
Marie-Laure DENIS
This decision may be appealed to the Council of State within two months of its notification.