CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Investigation of the case:
Paris, on
26 JUIL. 2022
Ref. No.:
Referral no.
(to be quoted in all correspondence)
Dear Sir,
I am following up on the complaint of sent to the Commission Nationale de l'Informatique et des Libertés ("CNIL") by the Sarre data protection authority (Germany) in application of the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
lodged a complaint with his local data protection authority against concerning the difficulties encountered in exercising his right to erasure of his customer accounts (respectively linked to the emails and and to the customer identifiers : and ).
In particular, stated that he had not received confirmation that his requests had been taken into account and that he had been forced to provide an identity document beforehand, even though he was connected to his customer account.
The exchanges that took place between the CNIL and the Data Protection Officer (DPO) of in the context of the investigation of this complaint, revealed the following elements.
On the basis of the research carried out by your departments, it was indicated that the erasure requests relating to 's two customer accounts were indeed taken into account on 18 May and 4 August 2021 and that obtained confirmation of this on the same days. Supporting documentation was provided to prove this.
Concerning the prior provision of an identity document, your DPO specifies that such a document is systematically requested when the request to exercise rights is made from the form available on the website without authentication on a personal account being required.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant ou délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
In this case, it was reported that the officer in charge of the initial ticket created by [REDACTED] from his [REDACTED] customer area mistakenly redirected him to the above-mentioned form. This was due to the fact that [REDACTED] had chosen the topic “Non-compliant service”, which did not correspond to the purpose of his request, instead of “GDPR” or “Account closure”. Thus, it had not reached the relevant team. I note that [REDACTED]’s tools now make it easier to move a ticket from one subject line to another, and that the DPO has undertaken to raise staff awareness in this respect. I also note that an information notice under the online form now invites [REDACTED] customers to make requests to exercise their rights from their personal space in order to avoid having to provide proof of identity.
The explanations provided and the measures already taken to avoid repeating the facts that are the subject of this complaint have led me, in agreement with the other European data protection authorities, to close it.
However, this decision does not preclude the CNIL from making use, particularly in the event of new complaints, of all the powers granted to it by the GDPR and by the French Data Protection Act of 6 January 1978 as amended.
Yours sincerely,
Marie-Laure Denis
Copy sent to [REDACTED], Data Protection Officer