CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
75002 PARIS
Examination of the case:
Paris, on
25 JUIN 2021
No./Ref. : MLD/KKR/XD/DAU/CM212739
Case no. 20007016
(To be referenced in all correspondence)
Dear Mr. Chief Executive,
This is further to the exchanges that took place between the services of the French data protection authority (Commission nationale de l'informatique et des libertés « CNIL ») and the data protection officer of the within the framework of the examination of Mr. complaint, transmitted to the CNIL by the German data protection authority from the land of Berlin (« Berliner Beauftragte für Datenschutz und Informationsfreiheit ») pursuant to Article 56.1 of the General Data Protection Regulation (« GDPR »).
had lodged a complaint with his personal data protection authority against the concerning the registration process on the website < > which required, according to him without any explanations, to deliver the copy of an identity document (passport or national identity card).
Our exchanges lead me, in agreement with other European data protection authorities concerned by the processing of data of individuals who sign up on the platform, to proceed to the closure of this complaint.
Indeed, you have confirmed us that the provision of an identity document is not necessary for signing up on the platform, whose purpose is to connect « freelances » and customers holding projects.
Nonetheless, you have specified that the delivery of such document is required for « freelances » who want to obtain a “checked” profile (for instance, for certifying that they are authorised to work within the European Union), or to benefit from a secured payment of their missions or from a cash advance, in accordance with law against money laundering or terrorism.
In this particular case, the complainant - who has registered as « freelance » on June 14th, 2019 - did not had to communicate an identity document for such registration.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
I nevertheless draw your attention on the necessity to enhance the information delivered in the « charter for protection of personal data » available on your website in French version at [REDACTED] in order to better reflect the elements provided in response to the Commission within this complaint.
This charter should notably specify for each purpose of processing the associated legal basis. In this regard, your company is not entitled to rely on the legal basis of legal obligation for its processing of identity proofs, since the obligations relating to money laundering or terrorism fight are only imposed on its payment [REDACTED] or factoring services [REDACTED] providers partners.
Yours Sincerely,
Marie-Laure DENIS