CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Registered letter with acknowledgement of receipt
Investigation of the case:
Our Ref. :
(to be quoted in all correspondence)
Paris, on October 14th, 2022
Dear Madam Chair,
I am following up on the various exchanges that have taken place between the services of the CNIL (French Data Protection Authority) and the Data Protection Officer of as part of the investigation of a complaint sent to us by the Bulgarian data protection authority pursuant to Article 56.1 of the General Data Protection Regulation (GDPR).
The complaint concerned the difficulties encountered by who had received an invoice from your company after having paid all the costs, as well as several notices of violation from the French and Belgian authorities for offences committed in Lille and Kortrijk concerning a vehicle registered in France even though he had not gone to these cities.
I noted that the problem was caused by "a manual error by an agent" which "led to a confusion of the data" of the complainant with those of another customer of your company. In this respect, the CNIL services were informed that measures were taken against the employee who caused the problem, and all employees were reminded of the procedure applicable to the qualification and identification of customers.
In addition, I note that steps have been taken by to reimburse invoice and to regularise his situation with the French and Belgian agencies responsible for handling petty offences.
I have also noted that your organisation did not make a data breach notification as you considered that the data concerned were few in number and not sensitive, and that there was no particular risk due to the quality of the individuals who received said data (public authorities).
The answers provided and the measures taken by read, in agreement with the other European data protection authorities concerned by your processing, to the closure of this complaint.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant ou délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
However, if there are new complaints, the CNIL reserves the right to make use of all the powers granted to it by the GDPR and by the French Data Protection Act of 6 January 1978 as amended.
Yours faithfully,
Copy sent to Data Protection Officer for