**CNIL**
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The President
Registered letter with acknowledgement of receipt
AR ref. no:
Paris, 18 AOUT 2022
Investigation of the case:
Our Ref.:
Referral No.
(to be quoted in all correspondence)
Dear Madam,
The Commission Nationale de l’Informatique et des Libertés (CNIL) has received a complaint sent by the Irish data protection authority, filed by [REDACTED] owing to the difficulties encountered with the services of [REDACTED] and [REDACTED] in exercising his right of access.
## I. Background to the complaint and events
The complainant, wishing to obtain a copy of his personal data and information relating to the purposes for which they were collected and the categories of personal data concerned, indicated that he made an initial access request using an online form. In the absence of any response, he reiterated his request three months later by email on the 9$^{th}$ September 2019, sent to [REDACTED] and [REDACTED]
[REDACTED] responded to the complainant who on the 18$^{th}$ December 2019 requested access to his telephone communications with the company’s services. The following day, the company asked him for additional information (the telephone number used, the number called and the time of the call). I note that the complainant has not provided the information allowing the data controller to conduct the necessary searches to respond to his request and that telephone recordings are kept for three months.
The processing of personal data by [REDACTED] is cross-border within the meaning of Article 4 of the General Data Protection Regulation (GDPR) and is therefore part of the European cooperation mechanism (the so-called “one-stop shop”) pursuant to the provisions of Article 56 of the GDPR. CNIL acts as the lead authority for this processing carried out by [REDACTED]
Discussion with the [REDACTED] DPO has led me to note the following points.
## II. Analysis of the facts in question: failure to respond within the time limits to a request to exercise a right
Pursuant to the GDPR, the data controller must respond to an access request without undue delay and in any event within one month of receipt of the request (Article 12.3 of the GDPR).
In this case, I note that [REDACTED] acknowledged receipt on the 6$^{th}$ November 2019 of the email of the 9$^{th}$ September 2019, and requested additional information to check the identity of the claimant, this being almost two months after this email which itself followed an initial online request from the
RÉPUBLICQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees personnelles.
complainant, which was reportedly made three months previously and was reportedly unanswered.
In substance, the complainant received a response to his access request by email of the 18th December 2019.
I therefore consider that disregarded Article 12.3 of the GDPR by responding to the complainant after the deadline stipulated.
On the basis of all known factors, and in agreement with the other data protection authorities affected by this processing operation which have been consulted, the following corrective measures must therefore be imposed against
- A REPRIMAND FOR INFRINGING THE REGULATION in accordance with the provisions of Article 58.2. b) of the GDPR and Article 20.II of France's Law No. 78-17 of the 6th January 1978 on Information technology, data storage and freedom of information, with regard to a breach of the obligation to respond within the time limits to a request to exercise a right.
Finally, I would like to point out that this decision, which closes the investigation of the complaint, does not exclude the CNIL from making use, particularly in the event of new complaints, of any of the other powers attributed to it by the GPDR and by the French law of the 6th January 1978 as amended.
CNIL's services (lawyer advising on the exercising of rights and complaints, are available to you for any additional information.
This decision may be appealed before the French State Council within two months of its notification.
Yours sincerely
Copy to Data Protection Officer at