CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The Chair
Paris, on
01 OCT. 2021
Registered letter with acknowledgement of receipt
AR No:
Ref. No. : MLD/LCN/RAL211029
Referral no. 21008089
(to be quoted in all correspondence)
Dear Sir,
I am following up on the various exchanges that have taken place between the services of the Commission Nationale de l'Informatique et des Libertés ("CNIL" - French Data Protection Authority) and the Data Protection Officer of [REDACTED] as part of the investigation of [REDACTED]; [REDACTED] complaint sent to CNIL by the Austrian authority for the protection of personal data pursuant to Article 56.1 of the General Data Protection Regulation ("GDPR").
[REDACTED] had lodged a complaint with his national data protection authority against [REDACTED] concerning difficulties in exercising his right to erasure.
The failures noted at the time of the exchanges between CNIL and [REDACTED] lead me, in agreement with the other European data protection authorities concerned by the processing implemented, to remind [REDACTED] of its obligations, in accordance with the provisions of article 58.2.b) of the GDPR.
In this case, the complainant, holder of the email address [REDACTED] sent an account deletion request by email on 6 March 2021 which went unanswered. Subsequently, the complainant made a follow-up via a "support ticket" dated 2 April 2021 for which he was informed that he had to wait for the response from the team dedicated to the protection of personal data. Indeed, the "support" team had no indication of these procedures.
[REDACTED] indicates that it has deleted the account of [REDACTED] but that it only informed him on 25 June 2021.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant ou délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
However, I remind you that in accordance with the provisions of article 12.3 of the GDPR, the data controller is required to respond to the person who made a request in application of articles 15 to 22 of the GDPR, indicating the measures taken as a result of his request as soon as possible "and in any event within one month of receipt of the request."
Therefore, I call you to order by this letter on the need to respond to people making a request to exercise their rights within the legal period of one month, which may be extended by two months if necessary, in particular in the event of the complexity of the request.
Finally, I would like to point out that this decision, which closes the investigation of [REDACTED] complaint, does not exclude the CNIL from making use, particularly in the event of new complaints, of all the other powers attributed to it by the GPDR and by the amended Act of 6 January 1978.
Yours sincerely,
Marie-Laure DENIS
This decision may be appealed before the Council of State within two months of its notification.