CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The Chair
Registered letter with acknowledgement of receipt
AR No: 2C 151 961 6145 9
Investigation of the case:
Paris, on
09 MAI 2022
Ref. No.: MLD/JTI/
Referral No.
(to be quoted in all correspondence)
For the attention of the Chief Executive Officer,
I am following up on the exchanges that have taken place between the departments of the Commission Nationale de l'Informatique et des Libertés ("CNIL" - French Data Protection Authority) and the Data Protection Officer of as part of the investigation of 's complaint, transmitted to the CNIL by the Bavarian Data Protection Authority.
In this case, stated that he had requested, by email, on 11 December 2020, the deletion of his first name and surname, his date of birth and his email address. He specified that he wanted to receive confirmation of this deletion. On 12 December 2020, the customer support service informed him that his request had been forwarded to the Data Protection Department and specified that said data would be immediately deleted. He was informed that he would not receive confirmation of this deletion but that he could consider this message as such.
However, the applicant continued to receive emails from on the 25th of December 2020 and on the 1st and 22nd of January 2021, which is forty days after his initial request.
During discussions with your DPO, it was mentioned that at the time of the erasure request, was using the services of an external partner to process exercise of rights requests and that it failed to send the request immediately despite the message sent to the applicant to confirm that the data would be deleted. Your DPO states that the winter holiday period also probably delayed the transfer of the request to its service provider.
Your DPO has stated that since then, the applicant's personal data have been anonymised and that he has been informed of the erasure of his personal data.
He has also stated that since then, has taken measures to reduce the processing times of exercise of rights requests by introducing a new priority processing process and modifying the responses made to applicants when they request a deletion so that they only receive confirmation of the erasure of personal data once such personal data have been effectively erased.
The explanations provided as to the circumstances of this isolated incident and the measures already taken to avoid repeating the facts that are the subject of this complaint have led me, in agreement with the other data protection authorities concerned by this cross-border processing, to close it.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
However, if there are new complaints, the CNIL reserves the right to make use of all the powers granted to it by the GDPR and the French Data Protection Act of 6 January 1978 as amended.
Yours sincerely,
Marie-Laure DENIS
Copy to: Data Protection Officer at
This decision may be appealed before the French Conseil d'Etat within two months of its notification