CNIL
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The President
LETTRE RECOMMANDÉE AVEC AR
N°AR :
Examination of the case:
Our Réf.: RAL2
Case no. 21003605
(to be referenced in all correspondence)
Paris, on 18th March 2022
Dear Mrs Director general,
I am following up on the exchanges that took place between the CNIL's departments and the
previous Data Protection Officer (DPO) of as part of the investigation of s
complaint concerning the difficulties encountered in exercising his right to delete his online account with
s services.
The complainant, who had an online account on the website that he
had not used since 2017, noted that, contrary to what is stated in the general terms of use, his account had
not been deleted after 24 months of inactivity. He encountered difficulties in exercising his right to erasure.
This complaint concerns cross-border processing within the meaning of Article 4 of the General
Data Protection Regulation (GDPR) and which is therefore part of the European cooperation mechanism
pursuant to the provisions of Article 56 of the GDPR.
The exchanges with your DPO lead me to note the following elements.
1. Firstly, with regard to the lack of automatic deletion after a long period of inactivity of the
customer's account, I note the occurrence of a malfunction in the automatic
account purging process at the end of 2019 and the impact of the current health crisis on
the re-establishment of this purging functionality, which was due to be reactivated during
June 2021.
Nevertheless, this situation led the company to keep its customers' personal data for longer than
necessarily intended.
However, personal data must not be kept in a form which permits identification of data subjects for
longer than is necessary for the purposes for which they are processed (Article 5(1)(e) of the GDPR). I
therefore consider that the company has breached these provisions.
2. Secondly, with regard to the deletion request made by in an e-mail dated
January, 10th 2021, s services came back to him by e-mail dated February, 17th
to ask him to provide a copy of his identity document.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL
via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
However, in accordance with the provisions of Article 12(3) of the GDPR, the controller is obliged to respond to the person who has made a request pursuant to Articles 15 to 22 of the GDPR, indicating the measures taken in response to his or her request as soon as possible "and in any event within one month of receiving the request".
I therefore consider that the company failed to comply with Article 12.3 of the GDPR in that it did not provide the complainant with information on the outcome of his request within one month of receiving the request.
I note, however, that in its reply of June, 7th 2021, [REDACTED] s DPO informed the CNIL that the complainant's account and personal data had indeed been deleted in accordance with Article 17(1) of the GDPR, after the intervention of the CNIL on May, 3rd.
3. Thirdly, with regard to the request for identification, I note that [REDACTED] had made his request for deletion of his account from the e-mail address linked to it.
In your response to the CNIL, it was indicated that the request by your services for a copy of the applicant's identity document is a standard procedure applied for requests to exercise the most sensitive rights. You stated that following proven cases of attempted identity theft and an internal analysis, it is necessary to "maintain this verification stage, particularly when requests are linked to the exercise of a right of access or a right to erasure, the processing of which may present risks (disclosure or destruction of data) for the data subjects in the event of identity theft". Moreover, this verification would enable you to rule out any risk of homonymy.
I would remind you that while it is up to the controller to ensure that the applicant is indeed the data subject, by requiring him or her to prove his or her identity if necessary, no more data than necessary should be requested in application of the minimisation principle provided for in Article 5(1)(c) of the GDPR.
For this purpose, the level of checks to be carried out under Article 12(6) of the GDPR must therefore vary according to the nature and the context of the request. If an identity document can, for example, be requested in the event of suspected identity theft or account hacking, it seems disproportionate to systematically require it if the applicant makes the request from a secure personal space (customer account) or when the request is made from the e-mail address attached to his or her customer account.
The systematic collection of all the data mentioned on the identity document therefore appears, in the light of this provision, to be excessive and contravenes the principle of minimisation laid down by Article 5(1)(c).
The breaches of Articles 5(1)(e), (c), and 12(3) of the GDPR lead me, in agreement with the other European data protection authorities concerned by the processing of your customers' accounts, to remind [REDACTED] of its obligations, in accordance with the provisions of Article 20 II of law n°78-17 of January 6th, 1978 known as "Informatique et Libertés".
Consequently, with this letter, I remind you of the need to ensure that you respect the time limits for storing your customers' personal data and the need to respond to requests to exercise the rights within the time limit provided for by the GDPR, without systematically requiring the production of a copy of an identity document.
I nevertheless take note of the measures already taken to improve the procedures for exercising the rights of the data subjects, through the increased awareness of [REDACTED] staff and the changes to the information on your website.
I would like to point out that if this decision closes the investigation of [REDACTED]'s complaint, the CNIL reserves the right, in case of new complaints, to use all of the powers conferred to it under the GDPR and the law of 6 January 1978 as amended.
Yours Sincerely,
Copy to
Data Protection Officer
Subject to the applicants' interest in acting, this decision may be appealed before the French State Council within a period of two months following its notification.