CNIL
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Registered letter with acknowledgement of receipt
AR ref. no: 2C 151 961 6691 1
Investigation of the case:
Paris, on September 29, 2022
Our Ref.:
Referral
(to be quoted in all correspondence)
Dear Sir/Madam,
I am following up on [REDACTED] s complaint sent to the Commission nationale de l'informatique et des libertés (CNIL) by the Commission nationale pour la protection des données du Grand-Duché de Luxembourg (CNPD) in application of the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
The complainant lodged a complaint with his national data protection authority, on 24 September 2021, against [REDACTED] a company established in France, for failing to comply with his request to object to the processing of his personal data and to erase his personal data.
In particular, [REDACTED] stated that after receiving confirmation that his requests had been taken into account on 17 September 2021, he received a promotional text message on 24 September 2021.
The exchanges that took place between the CNIL and [REDACTED] s Data Protection Officer (DPO) in connection with the investigation of this complaint show that the request to object to the processing of his personal data and to erase his personal data, made by [REDACTED] on 17 September 2021, was not initially taken into account in an effective manner. The DPO states that a management error caused a delay between the sending of the confirmation by email sent on 17 September 2021, and the actual processing of the request on 27 September 2021.
I take note of the fact that the complainant's request to exercise his rights was finally taken into account, 10 days after his initial request, and that the customer account and all the personal data attached to it have indeed been deleted, as shown in particular by the screenshots of your marketing databases attached to the reply letter of 21 April 2022 sent by your DPO. I also note that the complainant was informed of this by e-mail on 27 September 2021.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
The explanations provided lead me, in agreement with the other European data protection authorities involved, to close this complaint.
However, if there are new complaints, the CNIL reserves the right to make use of all the powers granted to it by the GDPR and the French Data Protection Act of 6 January 1978 as amended.
Regards,
On behalf of the President
Copy to Data Protection Officer