CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# REGISTERED LETTER WITH
ACKNOWLEDGEMENT OF RECEIPT
Chief Executive Officer
Investigation of the case:
Paris, on 24 MAI 2023
Our Ref.: CM
Referral no.
(to be quoted in all correspondence)
For the attention of the Chief Executive Officer,
I am following up on the exchanges that took place between the departments of the Commission nationale de l'informatique et des libertés ("CNIL" – French data protection authority) and the data protection officer of (referred to as "VP Legal & Compliance") as part of the investigation of complaint, forwarded by the Hamburg data protection authority, in application of the provisions of Article 56.1 of the General Data Protection Regulation (GDPR).
The complainant lodged a complaint with his national data protection authority on 27 June 2022 against , a company established in France, for failing to take sufficient measures to comply with his request to erase all his personal data.
In particular, the complainant indicated that he had requested the erasure of all personal data concerning him and the deletion of his user account on 20 June 2022. On the same day, your customer service would have confirmed the deletion of his account and the deletion of said data by specifying that he would no longer receive commercial prospecting emails. However, the complainant received a commercial prospecting email on 24 June 2022.
First of all, with regard to your internal investigations, I have taken note that they revealed an "error in the configuration of this procedure" for the deletion of personal data, as your two databases, one relating to active customer accounts and the other dedicated to commercial prospecting, were not synchronised. Thus, the erasure measures implemented in the first were not automatically passed on in the second.
Then, with regard to the particular case of the complainant, I note that his customer account and the associated personal data were erased, upon receipt of his request in June 2022 and that his email address from the commercial prospecting database was manually deleted on 9 November 2022.
Finally, with regard to the measures taken to avoid the reiteration of such a situation, I note that an inventory of all erasure requests is in progress within your departments in order to identify any other cases that may have been impacted by this configuration error.
I also observe that measures to modify your internal procedure have been taken, in the short term, by replacing the current automatic procedure a request addressed to each of the departments in order to ensure the effective erasure of the personal data referred to in a request and, in the long term, by developing an automatic synchronization tool for all your databases.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees personnelles.
Consequently, the explanations given as to the circumstances of this incident and the measures already taken to avoid a repetition of the facts which are the subject of this complaint lead me, in agreement with the other European data protection authorities concerned by your processing operations, to close it.
However, if there are new complaints, the CNIL reserves the right to make use of all the powers granted to it by the GDPR and by the French Data Protection Act of 6 January 1978 as amended.
Yours sincerely,
For the CNIL Chair and on her behalf,
Copy to: VP Legal & Compliance