CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Registered letter with acknowledgement of receipt no.
Investigation of the case:
Paris,
21 DEC. 2023
(to be quoted in all correspondence)
Dear Madam,
I am writing in response to the exchanges between the services of the Commission nationale de l'informatique et des libertés (CNIL) French DPA and the data protection officer of [REDACTED] as part of the investigation of the complaint lodged by Mr [REDACTED] with the Polish Data Protection Authority on 18 December 2021 and forwarded by the latter to the CNIL, pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
According to Mr [REDACTED], his personal data was collected as part of a recruitment procedure. He requested its deletion by email dated 3 November 2020 to privacy@ [REDACTED] and again by email dated 25 November 2020 to dpo@ [REDACTED]. However, Mr [REDACTED] is said to have subsequently received emails about recruitment offers, in particular from no-reply@recruitment [REDACTED]
Firstly, with regard to your internal investigations, your departments confirmed that they had acknowledged receipt of the applicant's request for deletion of his personal data on 03 November 2020 (in the privacy@ [REDACTED] mailbox) and on 25 November 2020 (in the dpo@ [REDACTED] mailbox). I have taken note of the fact that this request was indeed received by your departments but that "due to a human error, the process was not completed".
With regard to the action taken in response to the applicant's request, you indicated that in view of the situation described below, the date of the applicant's initial request (03/11/2020), the date of referral to the Polish data protection authority (18/12/2021) and in order to avoid erroneous deletion, you contacted the applicant one last time to make sure that his request was still valid (action taken from the dpo@ [REDACTED] mailbox on 21/10/2022). As the applicant confirmed his request for deletion on the same day, his personal data and candidate area were deleted from your databases on 21/10/2022.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
Lastly, with regard to the measures taken to prevent a recurrence of such a situation, I have taken note of the fact that since October 2021, applicants have been able to delete their personal data and their account from their applicant area, and that the process for handling requests to exercise rights has been reviewed and centralised.
Consequently, the explanations given as to the circumstances of this incident and the measures already taken to avoid a repetition of the facts which are the subject of this complaint lead me, in agreement with the other European data protection authorities concerned by your processing operations, to close it.
However, if there are new complaints, the CNIL reserves the right to make use of all the powers granted to it by the GDPR and by the French Data Protection Act of 6 January 1978 as amended.
Yours sincerely,
For the CNIL Chair and on her behalf,
Copy to your Data Protection Officer.