CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Paris, on 16 JUIN 2021
Registered letter with AR
AR No: 8C137386 00214
Ref. No. : MLD/CHT/RAL21001002
Referral No. 18016405
(to be quoted in all correspondence)
Dear Sir,
I am following up on the complaint from , which was forwarded to the Commission Nationale de l'Informatique et des Libertés (CNIL) by the German data protection authority of the Land of Lower Saxony ("Die Landesbeauftragte für den Datenschutz Niedersachsen") in accordance with the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
lodged a complaint with his national data protection authority against the company , publisher of the website , established in France, concerning the difficulties encountered in exercising his right to the portability of his personal data and his request for information regarding the processing of such data.
The exchanges that have taken place between your company and CNIL services in the context of the investigation of this complaint lead me, in agreement with the other European data protection authorities concerned by the processing of data from users of your website, to remind of its obligations regarding the following points, in accordance with the provisions of Article 58.2.b) of the GDPR.
Firstly, exercised his right to the portability of his personal data following the deletion of his account by . Your company simply responded to him that all his personal data had been deleted and that no backup was possible.
However, during the exchanges with my services in the context of the investigation of this complaint, you attached to your reply of 8 September 2020 a copy of documents containing personal data concerning the complainant, which had been kept despite your statements, and in particular the introduction that he had posted on his former profile (under the heading, "about me"), as well as administrative data (such as his user name, date of birth, name, gender, etc.).
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
However, I would remind you that Article 20 of the GDPR provides that “the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format”.
Thus, you should have sent the complainant the personal data that he provided to you when registering on the website, and in particular his introduction (“about me”) as well as the administrative data kept, following the exercise of his right to data portability.
Secondly, in his exchanges with services, the complainant also requested “Immediate delivery of the complete GDPR information.” He was thus exercising his right of access to information about the processing of his personal data.
In this respect, I remind you that any person may request from the controller confirmation as to whether or not data relating to him or her are being processed and, if so, access to such data as well as to the information indicated in Article 15 of the GDPR (purposes of the processing, categories of personal data concerned, recipients or categories of recipient to whom the data have been or will be disclosed, etc.).
Thus, services should have responded to the complainant by providing him with all the information relating to the processing of his personal data in accordance with Article 15.1 of the GDPR.
Finally, and in general, in view of the elements indicated in complaint, I note that the answers given to the complainant by your services were succinct.
However, I must remind you that when providing any communication related to the exercise of rights, you must take appropriate steps to make any communication “relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, [...]” (Article 12.1 of the GDPR).
Similarly, if you do not respond to requests from data subjects to exercise their rights, you must inform them without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority (the CNIL in France) and seeking a judicial remedy (Article 12.4 of the GDPR).
Thus, services should also have informed the complainant of his right to lodge a complaint with his supervisory authority and to seek a judicial remedy.
In view of the above, the small size of your company and the difficulties encountered in processing the complainant’s request, and in order to prevent such failures from recurring in the future, I invite you to seek support in your efforts to comply with the GPDR, in particular in order to implement effective procedures for managing requests to exercise rights.
To help you with that, you will find a lot of information on this subject on the CNIL website, in particular on the “Compliance tools” page, which can be accessed via the following URL https://www.cnil.fr/fr/les-outils-de-la-conformite.
Finally, I would like to point out that this decision, which closes the investigation of [REDACTED] complaint, does not exclude the CNIL from making use, particularly in the event of new complaints, of all the other powers granted to it by the GPDR and by the amended Act of 6 January 1978.
Yours sincerely,
Marie-Laure DENIS
This decision may be appealed before the French State Council within a period of two months following its notification.