CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Letter with acknowledgment of receipt
Examination of the case:
Paris, on 16 MARS 2022
No./Ref. :
Complaint no.
(to be referenced in all correspondence)
Mr. Managing Director,
This is further to the exchanges that took place between my services and the legal manager of the (hereinafter the in the context of the examination of complaint, which had been transmitted to us by the German data protection authority of Schleswig-Holstein pursuant to the cooperation procedures between European authorities (Articles 56.1 and seq. of the General Data Protection Regulation "GDPR").
This complaint concerned the difficulties encountered by with the exercise of his right to access to his personal data concerning him and his right to erasure.
Indeed, the complainant indicates having exercised his right to access with the services by email dated September 21st, 2020 addressed to He indicates having then requested the deletion of his data by an email dated December 28th, 2020 sent to His requests have finally been taken into account solely after the intervention of CNIL's services.
First, your services specify that the contact address used for dealing with requests relating to the exercise of the individuals' rights, has been replaced by a secured tool for managing customer requests called They add that although this address keeps on being monitored by your customer relations department, it would now refer applicants, such as to the Ariane tool for the processing of such requests.
Yet, I recall you that Article 12.2 GDPR requires the data controller to facilitate the exercise of data subjects rights.
Therefore, individuals who have already exercised their rights by electronic means should not have to reiterate their requests by another mean.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
Second, concerning more specifically [REDACTED] access request, I note that your services haven't been able to find back the complainant's request neither on the electronic address [REDACTED] nor on the [REDACTED] tool, prior to the communication from our part of its registration number. This request has thus only been processed further to our intervention.
Concerning [REDACTED] erasure request, your company indicates that the latter being exercised to the electronic address used for responding to his access request [REDACTED] it would have been automatically archived without your services being aware of it. Your services argue that it is possible that such request has suffered from the health situation which "severely and rapidly overloaded [your] customer services in an unusual and prolonged way".
Your services now confirm having erased the complainant's data from your commercial tools and your email campaigns, provided however that the data concerning his last booking from 2018 are not yet entitled to the purge in your accounting and billing tools. I note that a response in this regard has been concomitantly transmitted to [REDACTED]
I remind you that it belongs to the data controller to follow up on requests relating to data subjects rights and to inform the latter of the measures taken in respond to these requests "without undue delay and in any event within one month of receipt of the request" (Article 12.3 GDPR).
Finally, I note that your company "regularly raises [its] teams' awareness and updates [its] processes to provide the best possible response and satisfaction to [its] customers" and in this regard, a common procedure to the requests relating to the exercise of the rights, including notably response templates validated by your data protection offer, as well as an annual awareness-raising of your teams has been put in place.
Nonetheless, all of the elements exposed above lead me, in agreement with other European data protection authorities concerned, to issue reprimands to the [REDACTED] on its obligations provided under Articles 12.2 and 12.3 GDPR, in accordance with the provisions of Article 58.2.b) of the GDPR.
I specify that this decision, which closes [REDACTED]'s complaint, does not preclude the CNIL from using, notably in case of new complaints, all its other powers that are granted by the GDPR and by the French law of January 6th, 1978 as amended.
Yours Sincerely,
This decision may be appealed to the French Council of State within two months of its notification.