CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The Chair
MONSIEUR LE DIRECTEUR GÉNÉRAL (THE
CEO)
Paris, le 13 novembre 2023
Our ref.:
(to be quoted in all correspondence)
Registered letter with acknowledgement of receipt No. 2C 156 060 1844 1
Dear Sir,
The main activity of the company is In
particular,
In accordance with on 15 September 2022 the
Commission nationale de l'informatique et des libertés (CNIL) carried out an online audit of the
website accessible from the URI created by . This audit continued with
an inspection at the company's premises and then again on
The purpose of this inspection was to verify the compliance of the processing carried out by
with the provisions of Regulation (EU) 2016/679 on data protection (GDPR) and Law No.
78-17 of 6 January 1978 as amended ("Data Protection Act"). In particular, this involved processing
several complaints brought before the CNIL concerning issues such as the failure to handle the right to
object to marketing.
The findings from these inspections, and the additional findings on 28 November and 7
December 2022, and 20 January, 27 March and 25 April 2023, prompt me to make the following
observations:
# I. As a preliminary point, on the improvements made to the processing
Article 12(2) of the GDPR provides that "the controller shall facilitate the exercise of data
subject rights under Articles 15 to 22", which includes in particular the right to object provided for in
Article 21. As such, the condition that in some cases governs the facilitation and effectiveness of the
right to object is whether it was expressed in advance. This interpretation is consistent with the spirit
of the GDPR, which aims to strengthen data subjects' control over their personal data, taking into
account the practical conditions of the processing operations implemented.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL
via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
In this case, by letter dated 25 April 2023, your company informed the CNIL of significant changes to the processing of
You stated that these changes were planned for introduction in June 2023.
First of all, I note the changes made to the information notices appearing on contract, which now very clearly specify the various processing operations implemented, including the processing, and also the terms and conditions for objecting to them. I also note that the deadline for sending offering a longer period for the data subjects to exercise their right to object.
It is my opinion that these measures should better ensure the effective right to object and preserve the rights and interests of the data processing subjects, while still allowing to pursue its legitimate interests.
# II. Analysis of the facts in question
# 1. Regarding the failure to uphold requests to exercise rights
In law, Article 12(2) of the GDPR states that “the data controller shall facilitate the exercise of data subject rights under Articles 15 to 22.” In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject”.
Article 12.3 of the GDPR states that “The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request”. If necessary, this period may be extended by two months, taking into account the complexity and number of requests. The controller shall inform the data subject of this extension and the reasons for the postponement within one month of receipt of the request. Where the data subject submits his or her request in electronic form, the information shall be provided electronically where possible, unless the data subject requests otherwise.”
Article 12.6 of the GDPR states that “without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.”
Finally, Article 17 of the GDPR specifies the conditions for exercising the right to erasure. In particular, Article 17-1 sets out a list of exceptions to the right to erasure, which allows, among other things, the retention of the data necessary for compliance with a legal obligation (for example, accounting) or for the establishment, exercise or defence of legal claims, even after exercising the right to erasure. Irrespective of whether a request is granted to exercise the right of erasure, in whole or in part, Article 12-3 of the aforementioned GDPR provides that the data controller shall inform the data subject of the measures taken following his/her request.
2
In this case, with regard to [REDACTED], the complainant referred the matter to the CNIL as a result of his difficulties in exercising his right of access to data concerning him. The delegation found that [REDACTED] had not responded to the complainant's request until 4 March 2021, despite the fact that [REDACTED] had received his request on 23 December 2020.
Furthermore, with regard to [REDACTED] ([REDACTED]), the delegation found that [REDACTED]'s customer service, in an email [REDACTED], had asked the complainant who had entered into a [REDACTED] contract to provide a copy of his identity document to enable him to exercise his right to object to commercial prospecting. With regard to [REDACTED] ([REDACTED]), the delegation noted the same situation, even though the complainant had provided his contract number in support of his claim.
Yet the collection of proof of identity in the context of the exercise of rights is permitted only in cases where there is a reasonable doubt as to the identity of the person, which does not appear to apply in this case. In general, the company could ask data subjects to prove their identity by less intrusive means; for example, by providing their contract number.
Finally, with regard to [REDACTED] [REDACTED] on 5 July 2021, the complainant made a request for personal data erasure. The Delegation noted that the reply sent to the complainant on 22 September 2021 stated that the data "have been deleted from our information systems." During the on-site inspection, the delegation found that the complainant's data were still being retained in the database, and the company stated to the delegation that this retention was justified for legal reasons, with the complainant's [REDACTED] contract still ongoing.
I therefore consider that [REDACTED] disregarded the provisions of Article 12 of the GDPR by not responding within the time limit given for requests for the exercise of rights, by requesting an identity document from a person exercising his/her right to object in the absence of reasonable doubt as to the identity of the person and by not informing the data subject of the retention of a portion of his data at the time of a request for erasure.
## 2. On the breach of the obligation to respect the right to object
According to the law, Article 21.2-3 of the GDPR provides that "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing." Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes."
Article 12.2 of the GDPR provides that "The controller shall facilitate the exercise of data subject rights under Articles 15 to 22."
In this case, the delegation was informed that [REDACTED] uses the data of persons who have subscribed to [REDACTED] service for direct marketing purposes by post. The Delegation noted that [REDACTED] allows individuals to object to the reuse of data from the [REDACTED] contract for marketing purposes by post via a check box.
3
Yet since 2020, the CNIL has received numerous complaints¹ which mention the receipt by the complainants of marketing materials by mail after having signed a contract in the despite their objection to such materials.
The delegation was informed that in the case of a subscription entered into in a , the individual is welcomed by a relationship manager who draws up the contract and enters the contract information in a (forwarding entry) application. The relationship manager is also required, in accordance with the procedures in force within , to ask the data subject if he/she wishes to object to the receipt of postal marketing materials, and to carry their answer over to the application.
The contract is then produced in paper format in duplicate. These two copies are submitted to the client, who must append their name and date and place of signature, and add their signature. An original copy of the contract in paper format is archived in the and the other is kept by the client.
In the event that the client, at the time of contract review, decides to object to receiving marketing materials by post by placing a handwritten check in the box for this purpose on the final contract at the time of its signature, this objection is not processed because it cannot be carried over to the “” application. Indeed, the input interface actually removes the modification option once the paper contract has been produced.
This means that any objection to receiving marketing materials that is expressed after the printing of the contract is not processed by .
The delegation also noted that, after the signature of contract, had processed some complainants’ objections to marketing, while others’ claims had still not been processed
It is therefore my opinion that the company disregarded the provisions of Article 21 of the GDPR in that it did not take the necessary measures to process the exercise of the right of objection of persons to the receipt of marketing materials by mail, and that it required the intervention of the CNIL before corrections were made to guarantee the effective right to object.
I therefore note the changes made by letter of 24 March 2023 in which informed the CNIL data privacy commission that it had updated the procedures in its distribution network.
Since April 2023, these have stated that if the customer manually ticks the box on the contract, it must be cancelled, reprinted and signed again.
In a , your company announced a revision to the information notices on the final contract of individuals by clarifying the statement on the use of data for marketing purposes.
¹
4
### 3. On the breach of the obligation to demonstrate the processing's compliance with the GDPR
According to the law, Article 24-1 of the GDPR provides that, "Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary."
In this case, with regard to [REDACTED], the delegation noted that [REDACTED] was unable to demonstrate the customer's choice of how their data would be shared with partners at the time of signature of the final [REDACTED] contract online in the event of disagreement between the customer and [REDACTED] on the value of this choice.
Indeed, [REDACTED] was unable to provide copies of contracts entered into by the complainants online, despite the requests for documents to this effect that were made by the delegation on the day of the audit.
In addition, with regard to [REDACTED] following the assertion by [REDACTED] to the customer of the inability to verify their choice relating to marketing for the contract taken out online, the company asked it to provide "a screenshot, a confirmation of order or any other document to verify that the non-sharing box had indeed been ticked." In response to the screenshot produced by the complainant which appeared to show that they had made a positive objection to marketing by mail, [REDACTED] stated to the delegation that this image could reflect a "current date" view on which the screen capture was made, which could differ from the status of the contract at the time of its subscription.
Yet the data controller is subject to an obligation to implement appropriate technical and administrative measures to enable it to demonstrate the compliance of the processing. In this way, in case of doubt, the company should be able to prove that the data subject had not objected to the sharing of his/her data at the time when the online contract was entered into. In any event, in the event of a dispute by a customer, it seems disproportionate to impose on them the burden of proof of their objection to marketing, given that such proof would be impossible to supply in the absence of a recording mechanism of a timestamped screenshot at the time of the electronic approval of the contract.
It is therefore my opinion that [REDACTED] disregarded the provisions of Article 24 of the GDPR by failing to implement technical measures that would make it possible to register the objection, or lack of objection, to marketing at the time of signature of the online [REDACTED] contract, and by reversing the burden of proof on individuals exercising their right of objection without providing them with the means to do so.
5
### III. Corrective action by CNIL (Article 20.II of the Law of 6 January 1978)
In light of all of the above, and in agreement with the other data protection authorities concerned by this processing, the following corrective measures must therefore be imposed against
- A LEGAL REPRIMAND, in accordance with the provisions of Article 20.II of the Law of 6 January 1978 with regard to the failure to take into account the right to object to marketing materials by post, and to the requirement to respond to requests for the exercising of individuals' rights within the required time limits ;
- AN ORDER in accordance with the provisions of Article 20.II of the Law of 6 January 1978, within a period of (3) months from the notification of this decision and subject to any measures it may have already adopted, to:
o comply with the conditions under which individuals may exercise their rights concerning their personal data, in particular by:
- requesting proof of identity of the individual exercising their rights in accordance with the provisions of Article 12 of the GDPR in cases where that individual can be identified otherwise, except in case of reasonable doubt as to their identity;
- ensuring that the right to object is considered for the purposes of sending marketing materials to data subjects.
o implement a mechanism for recording the customer's choice as to the sharing of their data with partners, at the time of signature of the final online contract, which would constitute proof for
This formal order, which does not require a response from you, confirms closure of procedure However, this closure is without prejudice to the right of the Commission to carry out a fresh audit procedure to confirm that your company has complied with this formal notice at the end of the time limit.
In the event of a fresh audit procedure, if your company has not complied with this formal order, a rapporteur will be appointed who may request the restricted committee to issue one of the sanctions provided for by Article 20 of the amended Act of 6 January 1978.
This decision may be appealed before the Conseil d'Etat within two months of its notification.
For more information on the formal notice procedure, you can consult the CNIL website at the following page: https://www.cnil.fr/fr/la-procedure-de-mise-en-demeure-0.
6
The Commission services
are at
your disposal if you require any additional information.
Yours sincerely,
Copy sent by email
to
, data protection officer at
7