CNIL
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The Chair
Registered letter with acknowledgement of receipt
AR ref. no:
Investigation of the case:
Paris, 26 SEP. 2022
Our Ref.
Referral no.
(to be quoted in all correspondence)
Dear Sir,
I am following up on the various communications that have taken place between the services of the Commission Nationale de l'Informatique et des Libertés ("CNIL" - French Data Protection Authority) and the Digital, Marketing and International Director of as part of the investigation of complaint sent by the data protection authority of the Land of Hesse (Germany) pursuant to article 56.1 of the General Data Protection Regulation (GDPR).
# I. Reminder of claims and facts
The complainant had lodged a complaint with his national data protection authority against concerning the appropriateness of the data collection carried out in connection with a complaint concerning a delivery problem.
In this case, placed an order on the website, which he never received. The complainant states that he reported these facts by email to the publisher of the website in question. He was then asked to fill in a form with his last name, first name, date and place of birth, occupation, postal address and family situation, and to send a copy of his identity card.
It appears that the standard data collection form used is in fact a "witness statement" form (Cerfa no. 11527-02), made available by the Ministry of Justice, to enable French citizens to inform the judge of litigious facts.
On this subject, your departments informed us that the use of a sworn statement was a procedure initiated by your delivery service providers in connection with a complaint linked to a delivery problem, and that the use of the "witness certificate" form (Cerfa no. 11527-02) was an error on the part of the customer service department, as the carrier does not require the use of such a form.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 75334 PARIS CEDEX 07 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
## II. Analysis of the facts in question
### 1. Breach of the data minimisation obligation
According to article 5.1.c) of the GDPR, the data collected must be adequate, relevant and limited to what is strictly necessary for the purpose.
In this case, you state that the collection of data was justified in order to enable your delivery service provider to follow up on the complainant's challenge.
However, I understand from the answers I received that the use of the Cerfa form no. 11527-02 was due to a failure in the order dispute procedure.
As such, I consider that [REDACTED] has breached article 5.1.c of the GDPR, by collecting more personal data than necessary for the purpose.
### III. Corrective action pronounced by CNIL (Art. 58-2 GDPR)
Due to the breach thus identified, and in agreement with the other data protection authorities concerned by this processing, the following corrective measures must therefore be imposed against [REDACTED]
- REPRIMAND, in accordance with the provisions of article 58.2. b) of the General Data Protection Regulation and article 20.II of the French Act no. 78-17 of 6 January 1978 on data processing, data files and individual liberties, regarding the obligation to process personal data that is adequate, relevant and limited to what is necessary for the purposes for which it is processed.
Lastly, I would like to point out that this decision, which closes the investigation of [REDACTED]'s complaint, does not exclude the CNIL from making use, particularly in the event of new complaints, of all the other powers attributed to it by the GPDR and by the amended Act of 6 January 1978.
However, I take note of the measures already taken to minimise the collection of personal data, in particular the introduction of a new sworn statement in which only the last name, first name, delivery address, order and parcel numbers and the date of dispatch to the data subject would be requested. I also note that the copy of the identity card is no longer required and that none of the information provided in the certificate is recorded by [REDACTED]
CNIL's services [REDACTED] lawyer advising on the exercising of rights and complaints, [REDACTED] are available to you for any additional information.
This decision may be appealed before the State Council within two months of its notification.
Yours faithfully,
