CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The Chair
LAAR n° 2C 151361628A4
Investigation of the case:
Ref. No.: MLD/VEI/RAL
Referrals No.
(to be quoted in all correspondence)
Paris,
20 MAI 2022
Dear Sir,
I am following up on the exchanges of letters that took place between the CNIL services and the data protection officer (DPO) of your company, as part of the investigation of several complaints relating to the processing of debtors' personal data (amicable collection files).
# I. Reminder of claims and facts
With regard to referral No.
The French complainant requested access to his data and received some responses. He nevertheless referred the matter to CNIL, feeling that the responses were incomplete, as the identity of the investigative agency at the origin of the data collection was not communicated to him. Following the intervention of CNIL services, his request was granted.
With regard to referral No.
The data relating to the French complainant were processed by [REDACTED] based on a debt assignment agreement entered into with [REDACTED]. The complainant has repeatedly requested the source of the data concerning him, as well as its retention period and its deletion. Following discussions with CNIL services, [REDACTED] informed the complainant that his address and telephone number had been obtained from an investigative agency located in Israel. Your DPO has indicated to CNIL that the use of such an agency occurs only when the data collected from the transferring institution turns out to be inaccurate.
In addition, the complainant was informed of the "exceptional" closure of his case and that his data will be deleted after a period of six years from that closure. Your DPO justified this period by the fact that your company is "legally required to keep this data for anti-money laundering purposes for a minimum of five years."
With regard to referral No.
In this complaint submitted by the Polish Data Protection Authority, pursuant to Article 56.1 of the General Data Protection Regulation (GDPR), the complainant challenged the lawfulness of the processing of data concerning him by [REDACTED] and requested its erasure. He indicated that he was not a debtor and had never been a client of the ceding company [REDACTED].
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL
via un formulaire en ligne ou par courrier postal. Pour en savoir plus: www.cnil.fr/donnees-personnelles.
From the complaint and the exchanges with your company's DPO, the following details emerge:
- after unsuccessfully attempting to contact the debtor concerned, [REDACTED] appealed to an investigative agency, which sent it the contact details of the complainant on 13 July 2018;
- on 23 July 2018, the complainant requested the erasure of the data from [REDACTED] after receiving [REDACTED]'s letter informing him of the existence of a claim concerning him;
- on 27 July 2018, he contacted [REDACTED] by email [REDACTED] to obtain information, as he claims never to have taken out a loan with [REDACTED].
- on 17 September 2018, he received another letter asking him to pay his debt;
- on 29 November 2018, during a telephone conversation with the complainant, [REDACTED]'s services noticed that this was a case of mistaken identity (same surname and first name). His telephone number was then invalidated, but no further action was taken;
- the complainant's address and telephone number were anonymised following the intervention of CNIL services on 26 August 2019 (all data relating to the complainant was replaced by crosses, thus preventing any link between the true debtor's file and the complainant);
- the complainant was informed that this measure would therefore put an end to all correspondence with him.
## II. Analysis of the facts in question
### 1. Failure to respond to requests to exercise rights
Pursuant to Article 12.3 GDPR, the Data Controller must respond to requests from individuals exercising their rights within a maximum period of one month.
In the present case, the Polish complainant attempted to obtain information on the processing of the data and requested its erasure upon receipt of the letter of assignment of claim.
An initial, insufficient measure was taken only four months after the complainant's first request. It is only the intervention of CNIL services - over a year after the complainant's first request - which led your services to respond satisfactorily.
I also note that compliance with this obligation and taking into account the complainant's requests from the outset could have enabled your company to identify the case of mistaken identity in July 2018 and thus immediately cease the processing of data concerning the complainant.
I find that [REDACTED] therefore disregarded Article 12.3 GDPR in that it did not respond to the complainant as soon as possible.
### 2. Failure to process accurate and up-to-date data
Pursuant to Article 5.1.d GDPR, the personal data processed must be accurate and, if necessary, kept up to date.
In this case, the case of mistaken identity was identified on 29 November 2018 when the Polish plaintiff disputed being a customer of the company and requested the deletion of his data. However, [REDACTED] did not take adequate measures to remove any doubt as to this homonymy and immediately delete the data concerning this non-debtor complainant.
Thus, the data relating to the complainant continued to be processed by [REDACTED] and was only anonymised after the intervention of CNIL services on 26 August 2019.
I find that [REDACTED] has therefore disregarded Article 5.1 d) GDPR in that it did not take the necessary measures to process only accurate and up-to-date data relating to a debtor and that it took the intervention of CNIL services to stop this breach.
2
I have noted, that following discussions with your DPO, measures have been taken to ensure that such events do not recur. Claims of mistaken identity are examined within one week, so that inaccurate data is no longer processed and that the data subjects are no longer contacted.
# 3. Breach of obligation to limit data retention
Pursuant to Article 5.1 e) GDPR, the data must be stored for no longer than is necessary for the purposes for which the personal data are processed.
In this case, when asked about the retention period for data concerning debtors, the DPO of your company explained that it is deleted after a period of six years from the closing of the amicable collection record concerning them because your company is "legally required to keep this data for the purpose of combating money laundering for a minimum of five years."
However, I believe that the retention of data for six years from the closing of a file in response to a general legal obligation "for the purposes of combating money laundering" which sets it at five years (Article L561-12 of the French Monetary and Financial Code) is contrary to Article 5.1 e) GDPR.
# 4. Breach of the obligation to inform the data subjects
Pursuant to Article 14 GDPR, where the personal data are not directly collected from the data subject, the Data Controller is required to inform that person of the source from which the data originated as such information appears "necessary to ensure fair and transparent processing". This information must be communicated as soon as possible (particularly during the first contact) and within one month at the latest.
In the present case, the information on the source of the data is necessary to enable the person to understand the scope of the data processing in question and, where appropriate, to fully exercise their rights. It emerges from the aforementioned complaints and investigations that the data subjects concerned by the processing related to the amicable collection of claims are not informed of the source of their personal data when they have been collected through a third party organisation.
Indeed, when the debtors' data are collected through a third party, attaching to the letter of assignment of claim sent to the debtor a copy of the privacy policy indicating the possibility of recourse to an investigative agency, does not fulfil this obligation. The information is not accurate enough and does not provide information on the exact source of the data.
As a result, the provisions of Article 14 have been disregarded by your company.
# III. Corrective measure declared by CNIL (Art. 58-2 GDPR)
Due to all of these breaches thus identified, and in agreement with the other data protection authorities concerned by this processing, the following corrective measures must therefore be imposed against
- A REPRIMAND, in accordance with the provisions of Article 58.2 b) of the General Data Protection Regulation (GDPR) and Article 20.II of the French Data Protection Act of 6 January 1978 as amended, with regard to the obligation to respond to requests for the exercise of the rights of individuals and the obligation to process accurate and updated personal data;
- A FORMAL NOTICE in accordance with the provisions of Article 58.2 d) of the General Data Protection Regulation (GDPR) and Article 20.II of the French Data Protection Act within one (1) month of the notification of this Decision and subject to the measures already adopted, on the one hand, to limit to five (5) years the retention period of the debtors' data from the closure of a file and, on the other hand, to correctly inform the individuals of the origin of the data concerning them used in amicable recovery procedures.
3
At the end of that period, if [REDACTED] demonstrates having complied with this formal notice, it will be considered that these proceedings are closed and a letter will be sent to it to that effect.
On the other hand, if [REDACTED] has not complied with this formal notice at the end of that period, I may refer to the restricted committee of the CNIL so that one or more of the sanctions provided for in Articles 20 et seq. of the French Data Protection Act of 6 January 1978, as amended, may be pronounced.
Yours sincerely,
Marie-Laure DENIS
This decision may be appealed before the French Conseil d'Etat within two months of its notification
4