CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Registered letter with AR
AR No: 2C 157 386 0318 4
Investigation of the case:
Our Ref.: MLD/CHT/CM21001365
Case n°20016122
(to be referenced in all correspondence)
Paris, on 09 JUIN 2021
Dear Sir
I am writing further to the complaint of [REDACTED], transmitted to the Commission nationale de l'informatique et des libertés (CNIL) by the data protection authority in Luxembourg ("the Commission nationale pour la protection des données du Grand-Duché de Luxembourg (CNPD)") pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
[REDACTED] lodged a complaint with his national data protection authority against the company [REDACTED], established in France, which had not responded to his request for access to his personal data, including the origin of the data.
The exchanges that have taken place between CNIL services and [REDACTED] Data Protection Officer (DPO) in the context of the investigation of this complaint lead me, in agreement with the other European data protection authorities concerned by prospecting and data management processing of your prospects, to close this complaint.
Firstly, with regard to the exercise of the complainant's right of access, I note that [REDACTED] request for right of access, made on 30 March 2020, was taken into account by your services which replied to him on 20 April 2020, i.e. within the one-month time limit provided for in Article 12.3 of the GDPR. I note that this response includes a description of the origin of the personal data concerning him, the legal basis for your data processing and a copy of all personal data concerning the complainant held by [REDACTED].
Although your DPO informed my services that the reply made to [REDACTED] did not include, in the body of the e-mail, all the information indicated in Article 15.1 of the GDPR, she nevertheless indicated that from now on the replies to requests for right of access will include all these elements.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
Secondly, I note that [REDACTED] has been solicited by your services on his professional address within the framework of a recruitment campaign in connection with his professional activity. Concerning the origin of the personal data concerning him, I take note that they were collected through recruitment platforms to which [REDACTED] would have communicated these data; platforms with which you are bound by a commercial contract.
Thirdly, with regard to informing individuals about the identity of the advertiser and the means of objecting to new solicitations, your DPO informed my services that the mail received by [REDACTED] was part of [REDACTED] first information campaigns, in which the identity of the data controller was shown (logo and redirection link to the website where the information was available) and a link was provided to the website to access unsubscribe procedures. Since then, marketing emails include more detailed information on the origin of the data, the purpose of the processing and its legal basis, the contact address of your data protection team, an unsubscribe link and a link back to your data protection policy.
Finally, your DPO has indicated to my services that [REDACTED] did not receive any further requests from [REDACTED] following the reply sent to him on 20 April 2020, and that he was never contacted again by your services for similar campaigns.
All these elements lead me to close this complaint against your organisation.
However, the CNIL reserves the right, in the event of new complaints, to make use of all the powers granted to it by the GDPR and the amended Act of 6 January 1978.
Yours sincerely
Marie-Laure DENIS
Copy to [REDACTED] Data Protection Officer