¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Registered letter with acknowledgement of receipt
AR ref. no: 2C 151 961 603 9
Investigation of the complaint:
Our Ref.:
Referral no.
(to be quoted in all correspondence)
Paris, on 02 AOUT 2022
Dear Sir/Madam,
I am following up on the complaint sent to the Commission nationale de l'informatique et des libertés (CNIL) by the Dutch Data protection authority [Autoriteit Persoonsgegevens], in application of the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
On 18 September 2021, the complainant lodged a complaint with their national Data protection authority against a company established in France, concerning the security of its customers' personal data.
In particular, the complainant informed their data protection authority of the fact that did not encrypt the passwords linked to its customers' personal space or at least they were accessible in clear text. They also said that passwords were sent in clear text via email when a user used the "forgot password" function on the website
In the course of the exchanges that took place between the CNIL and services, it was confirmed that a password management system as described by the complainant was indeed in place until 4 November 2021. I note, however, that on that date a new system was installed so that passwords are now stored in an encrypted and irreversible manner and the password recovery mechanism requires resetting the password.
The explanations provided and the measures already taken since 4 November 2021 to avoid a repeat of the events that are the subject of this complaint have led me, in agreement with the other European Data protection authorities involved, to close this complaint.
However, if there are any new complaints, the CNIL reserves the right to make use of all the powers granted to it by the GDPR and the French Data Protection Act of 6 January 1978 as amended.
Yours faithfully,
On behalf of the President,
Head of the department for the exercise of rights and complaints
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL
via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.