CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The Chair
Paris, on December 6, 2021
Ref. No. : RAL211026
Referral no. 20019819
(to be quoted in all correspondence)
Dear Director,
I am following up on the various exchanges that have taken place between the departments of the Commission Nationale de l'Informatique et des Libertés ("CNIL" - French Data Protection Authority) and the Data Protection Officer of as part of the investigation of 's complaint, transmitted to the CNIL by the Hungarian Data Protection Authority pursuant to Article 56.1 of the General Data Protection Regulation ("GDPR").
had lodged a complaint with his national data protection authority against a subsidiary of concerning the difficulties encountered in accessing information concerning the processing of personal data relating to the product recall procedure.
On receipt of this complaint, the Hungarian Data Protection Authority asked for information. The latter's counsel stated that was data controller concerning the processing of personal data relating to product recall, which was confirmed by 's data protection officer and led the CNIL to take up the investigation of this referral.
The failures noted at the time of the exchanges between the CNIL and lead me, in agreement with the other European data protection authorities concerned by the processing implemented, to remind of its obligations, in accordance with the provisions of article 58.2.b) of the GDPR.
In the present case, indicated that when he went to the cash register of the store, located at to purchase a product, he was asked to enter his email address in order to be notified in case of a product recall. The complainant then stated that he wanted to have the assurance that the personal data collected would be used only for the recall of the product.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
The store's customer service is said to have refused to provide such a guarantee and suggested that he refer to the privacy policy available on [REDACTED] website, [REDACTED]
However, although information on the processing of personal data concerning product recall was present on the [REDACTED] website, it did not appear on the decathlon [REDACTED] website.
On this point, I remind you that in accordance with Articles 12 and 13 of the GDPR, the data controller is required to provide data subjects with certain information on the processing of personal data concerning them in a concise, transparent, understandable and easily accessible manner, in clear and simple terms.
In this case, the privacy policy stated on the website [REDACTED] did not mention the existence of the processing of personal data relating to product recall, which constitutes a breach of Articles 12 and 13 of the GDPR.
Nevertheless, I note the changes made to the information notices on the website [REDACTED] following the intervention of the CNIL departments with the DPO of [REDACTED]. Indeed, the privacy policy entitled [REDACTED] now contains information on the processing of personal data relating to product recall.
A note has also been added at the bottom of the home page of the website [REDACTED] entitled [REDACTED] dedicated specifically to the processing of personal data relating to product recall.
Finally, I note that the processing of this case has led to the other [REDACTED] subsidiaries within the European Union also being alerted so that "the same level of information is accessible by all customers of the brand".
I would like to point out that this decision, which closes the investigation of [REDACTED] complaint, does not preclude the CNIL from making use, particularly in the event of new complaints, of all the other powers attributed to it by the GPDR and by the amended Act of 6 January 1978.
Yours faithfully,
This decision may be appealed before the State Council within two months of its notification.