¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Letter with acknowledgment of receipt
No.: 2C 156 060 5291 9
Examination of the case:
Paris, on November 22th, 2021
No./Ref.: RAL211050
Complaint no. 20006778
(to be referenced in all correspondence)
Mr. President,
This is further to the exchanges that took place between the CNIL's complaints department and the data protection officer of the company in the context of the examination of complaint, which had been transmitted to us by the Italian data protection authority pursuant to the cooperation procedures between European authorities (Articles 56.1 and seq. of the General Data Protection Regulation « GDPR »).
had lodged this complaint against after receiving on May 9th, 2019 an e-mail from showing the e-mail addresses of its 25 recipients.
First of all, I remind you that it belongs to the data controller to implement appropriate technical and organisational measures to ensure a level of security of personal data appropriate to the risk for the rights and freedoms of data subjects (Article 32 GDPR).
Concerning the personal data breach itself, the investigations led internally within your company reveal that « an update of the library used for the platform has led to some bugs, including one affecting personal data ».
I note that this incident has been resolved by your technical teams in few hours and that measures have been taken in order to prevent such incident from occurring again.
It appears indeed that some measures compliant with customs and state of the art, such as carrying out tests after each modification of the platform's source code or updating library for instance, could have prevented such an anomaly. I take note in this regard that tests covering the code which manages the sending of emails, such as the one at stake, have been reinforced since then and include now a specific check on the risk of disseminating the addresses of other recipients.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
Secondly, I note that the company has notified to the Commission this data breach (notification no. FR2 upon receipt of the letter addressed to it.
I remind you that each data controller has to notify the personal data breach to the supervisory authority competent without undue delay « and, where feasible, not later than 72 hours after having become aware of it » (Article 33.1 GDPR). Where this notification is not made within 72 hours, it shall be accompanied by reasons for the delay.
In this regard, I point out that your company has indicated that it has focused on fixing the incident and wrongly considered not being required to notify such violation « because of the low sensitivity of the concerned data (professional e-mail addresses) ».
Yet, as underlined by your services, the notification duty does not depend on the nature of the data at stake but whether or not there is a risk for their privacy, risk that did exist in this particular case in view of the disclosure concerned. I further observe that it stems from this notification that around 2000 individuals would in fact be concerned by such breach.
I take note however of the commitment taken by your company, for the future, to make sure to notify such type of incident to the CNIL, without undue delay. I note that an internal memo reminding the process to follow in case of data breach has now been issued to all services.
The explanations brought, the isolated nature of this incident as well as the measures rapidly taken by your services further to the Commission's intervention lead me, in agreement with other European data protection authorities concerned by the processing of data of individuals that have registered on the website to issue reprimands to the company on its obligations of security and notification provided under Articles 32 and 33 GDPR, in accordance with the provisions of Article 58.2.b) of the GDPR.
I specify that this decision, which closes complaint, does not preclude the CNIL from using, notably in case of new complaints, all its other powers that are granted by the GDPR and by the French law of January 6th, 1978 as amended.
Yours Sincerely,
This decision may be appealed to the French Council of State within two months of its notification.