CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Investigation of the case:
3rd July 2023
Referral no.
(to be quoted in all correspondence)
Dear Mr Chairman,
I am following up on the emails that have been exchanged between the Commission nationale de l'informatique et des libertés (CNIL)'s departments (French Data Protection Authority) and the Data Protection Officer for as part of the investigation into a complaint that was referred to us by the Swedish data protection authority in pursuance of Article 56.1 of the General Data Protection Regulation (GDPR).
The complaint concerned the difficulties that had experienced in exercising his right to the erasure of his personal data with your company.
The complainant advised that he sent you a message on 6 December 2021 to request the deletion of his customer account, whose identifier was no. . After asking him to confirm certain details of his account, your customer service department replied to him by email on 8 December 2021 and explained that his request had been transferred to the IT department to delete his account.
Since he had not received any confirmation that his account had been deleted as requested, sent a new message to on 8 January 2022. replied in a message dated 10 January 2022 that its IT department was trying to delete his account, but since it was another department, there was no way to specify how long it would take to complete the procedure. explained that he did not receive any subsequent confirmation from your company that his customer account had been deleted by your IT department.
I have noted that 's request was taken into account from 8 December 2021, that he received confirmation by email on 15 February 2023 that his account had been deleted, and that your organisation's investigations were unable to explain the reason for such late confirmation, insofar as all his data have been deleted, and the only information currently in your possession relates to his request to exercise his right to erasure.
RÉPUBLIQUE FRANÇAISE
3 Place de Formenoy, TSA 80713 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
The personal data required to perform the CNIL's missions are processed in files intended for its exclusive use.
Data subjects may exercise their data protection rights by contacting the CNIL Data Protection Officer via an online form or by post. For more
I also note that a reminder of the applicable procedure for managing data subjects' requests to exercise their rights has been sent to your customer service department to ensure that such requests are processed within the specified times.
Therefore, the answers provided by lead me, in agreement with the other European data protection authorities concerned by your processing operations, to close this complaint.
However, in case of new complaints, the CNIL reserves the right to use all the powers vested by virtue of the GDPR and the French Data Protection Act no. 78-17 of 6 January 1978, as amended, relating to information technology, files and freedoms.
Yours faithfully,
For the CNIL Chair and on her behalf,
