CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Investigation of the case:
Paris, on
30 JUIN 2021
Ref. No.: MLD/EMT/CM211960
Referral No.19007293
(to be quoted in all correspondence)
Dear Sir,
I am writing further to the exchanges that have taken place between the services of the Commission Nationale de l'Informatique et des libertés (CNIL - French Data Protection Authority) and the law firm, counsel for the company, in connection with the investigation of the complaint that was sent to us by the data protection authority of the Land of Berlin in Germany under the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
The complainant had stated that the website published by your company, did not have a data protection policy and that your company had not designated a data protection officer (DPO).
The exchanges referred to lead me, in agreement with the other data protection authorities concerned by the processing of personal data that you implement, to close this complaint.
Firstly, concerning the lack of a data protection policy and more generally of communication to the users of your website of the information provided for by Article 13 of the GDPR, the law firm drew the attention of the CNIL services to the fact that your website did have a confidentiality policy available in all the language versions proposed by your website (French, English, German and Italian).
On this point, however, it had become clear from informal verifications, particularly with regard to the German confidentiality policy, that it was not easily accessible. It was indeed accessible via the link "Rechtliche Hinweise" in the footer of your website. This title was not sufficiently clear, as this complaint demonstrates.
I note, however, that following exchanges between the CNIL and the law firm, your company has renamed the link to the confidentiality policy. The confidentiality policy is now accessible from the link "Schutz personenbezogener Daten und Rechtliche Hinweise". This new title facilitates access to the information required by Article 13 of the GDPR.
Finally, I would like to point out that, following exchanges between the CNIL and the law firm, your company has supplemented its confidentiality policy so that it includes all the information that must be provided to data subjects under Article 13 of the GDPR. As an example, your company has further detailed the rights conferred on data subjects by the GDPR.
1 Legal notice
2 Data protection and legal notice
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
According to the information provided by the law firm, the updated confidentiality policy is available in all language versions of your website.
Secondly, with regard to the designation of a DPO, I note that the conditions laid down in Article 37 of the GDPR are not met in this case.
The law firm has in fact stated that the core activities of your company do not involve any processing requiring "regular and systematic monitoring of data subjects" or the processing of special categories of personal data within the meaning of Article 9 of the GDPR; the processing operations implemented by your company are mainly aimed at managing the customer database.
As a result, your company is not required to designate a DPO.
In view of the efforts made by your company in connection with the exchanges between the CNIL and the law firm, I hereby inform you that I am closing the complaint against your organisation.
However, if there are new complaints, the CNIL reserves the right to make use of all the powers granted to it by the GDPR and the French Data Protection Act of 6 January 1978 as amended.
Yours faithfully,
Marie-Laure DENIS