CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Registered letter with acknowledgement of receipt
AR ref. no:
Paris, on 25 SEP. 2023
Our ref:
Case no.
(to be quoted in all correspondence)
Dear Sir or Madam,
I am following up on the various communications that have taken place between the services of the Commission Nationale de l'Informatique et des Libertés (CNIL) and the Data Protection Officer of as part of the investigation of Ms complaint sent by the national data protection authority of the Grand Duchy of Luxembourg (CNPD) pursuant to article 56.1 of the General Data Protection Regulation (GDPR).
# I. Background to the complaint and facts
The complainant filed a complaint with CNPD, its national data protection authority, against concerning requests for erasure and objection to the processing of personal data concerning her.
In this case, following the receipt of unsolicited marketing letters from , Mrs states that she exercised her rights to object and to erasure with by email of 18 September 2019 and 10 August 2020. By email of 12 August 2020, informed her that her request had been taken into account and stated that the prospecting letter received was sent directly by its service provider,
Following the receipt of a new prospecting letter, the complainant stated that she had contacted the company by email of 4 October 2020 in order to exercise her right to object. The company confirmed that her request had been taken into account, and told her "that she would be removed" from the mailing list for any subsequent communication. However, in March 2021, Mrs again received marketing material from . She therefore contacted her data protection authority.
After receiving this complaint from CNPD, the Commission approached the Data Protection Officer (DPO) of , who provided the following information.
Firstly, concerning the complainant's initial request for erasure and objection dated 18 September 2019 and addressed to "personaldata@ com", the company stated that this email address is an automatic email box whose messages are not processed, but are centralized and redirected to the correct department. It stated that an email was sent to the complainant inviting her to take further steps to submit her request via other channels (form to be filled out from a new URL link or email to another address). It stated that if this request was not sent to the department dedicated to requests to exercise rights, it could not be handled.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenay, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
Secondly, concerning the complainant's request for erasure made on 10 August 2020, the company stated that it responded to the complainant by email of 12 August 2020 informing her that, given that her data is held exclusively by its service provider, [REDACTED], it cannot itself delete said data. It nevertheless stated that it had passed on her request to [REDACTED]. As part of the investigation of the complaint, [REDACTED] confirmed to CNIL services that the complainant's request was handled on 12 August 2020. In addition, the company provided a screenshot showing the complainant's inclusion in an exclusion list.
Thirdly, concerning the request made by the complainant on October 4, 2020 to object to processing of personal data concerning her for direct marketing purposes, the company first stated that it had informed her by email of 5 October that her request had been taken into account. It then stated that it had explained to the complainant that "the right to object to receive marketing by post may take up to 4 months, as campaigns are organised a long time in advance", which was intended to explain the receipt of such a letter in October 2020.
Finally, with regard to the marketing received by the complainant in 2021 after she had exercised her rights to object and to erasure, the company confirmed to CNIL services by letter of 4 March 2022 that it did not have any personal data concerning Mrs [REDACTED] in her customer file and that it had no record in its information systems of having sent the complainant a marketing letter in 2021. However, it specified that, following a human error, the latter had been included only in the French exclusion list and not in the Luxembourg's one, which could explain the receipt of a new letter in 2021. Finally, the company stated that it had corrected this error, so that the complainant is now also included in the Luxembourg exclusion list.
Discussion with the [REDACTED] DPO has led me to note the following points.
# II. Analysis of the facts in question
# 1. Breach of the obligation to respond to requests from data subjects to exercise their rights in a timely manner
Pursuant to the GDPR, the data controller shall facilitate the exercise of data subject rights under Articles 15 to 22 (article 12.2 of the GDPR). The controller shall provide the data subject with information on the measures taken in response to a request made pursuant to Articles 15 to 22 as soon as possible and in any event within one month of receiving the request. If necessary, this period may be extended by two months, taking into account the complexity and number of requests. The controller shall inform the data subject of this extension and the reasons for the postponement within one month of receipt of the request (article 12.3 of the GDPR). In addition, if the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy (Article 12.4 of the GDPR).
In this case, I note firstly that the complainant sent her first request for erasure of personal data concerning her, on September 18, 2019, to the email address "personaldata@[REDACTED]:com". The information provided to individuals by the company indicated that this address allowed them to exercise their rights. In response, the company sent her an automatic message referring to a second procedure to be followed to respond to her request: if she wished to no longer receive information on the offers and services of [REDACTED] she was required to fill out a form accessible online, and if her request concerned an in-store purchase or any other request, she should then send an email to a second email address, "service.client@[REDACTED]:com".
It emerges from the above that the email address presented as enabling complainants to exercise their rights over personal data actually only enabled them to obtain information on how to exercise their rights; such information could have been directly accessible to persons, particularly in the privacy policy, which was not the case. When an individual wishes to exercise a right, he or she must be able to establish simply who they need to contact. Yet the email the complainant received in response to her request to exercise her rights asked her to exercise her rights again using one of two options (email or form). This therefore shows that the procedure does not facilitate the exercise of individual rights
I am of the opinion that [REDACTED] thus disregarded Article 12 of the GDPR by not facilitating the exercise of the complainant's rights and by not providing information on the measures taken following its first request dated 18 September 2019.
However, I note that the company has made improvements to its procedure; the "personaldata@[REDACTED].com" email address is now connected to customer service. I note, in particular, that in the complainant's follow-up communications, her request was directly handled by customer service, without the complainant being asked to exercise her rights via a new form or a second email address.
# 2. Breach of the obligation to respond effectively to requests from data subjects to exercise their rights to object and to have their data erased
Pursuant to the GDPR, data subjects have the right to require their personal data to be erased, in particular where the data are no longer necessary with regard to the purposes of the processing or when the data subject objects to the processing carried out for direct marketing purposes (Article 17 of the GDPR). In this way, when a person objects to the processing of personal data concerning him/her for direct marketing purposes, the data shall no longer be processed for this purpose (Article 21.3 of the GDPR).
In this case, the complainant received a marketing letter in 2021 from [REDACTED], owing to the fact that the complainant's objection had not been recorded into the company's Luxembourg database, due to an internal human error.
Yet, in its capacity as data controller, [REDACTED] should have ensured, following the complainant's initial request, that the requests to object and to erasure had been handled by [REDACTED], and also by its partner [REDACTED].
I therefore consider that [REDACTED] disregarded Articles 17 and 21.3 of the GDPR by not ensuring that the complainant's personal data was no longer being processed by [REDACTED] for marketing purposes.
I note, however, that following the exchanges between CNIL services and [REDACTED] services, the complainant's email address was registered in the French and Luxembourg exclusion files so as to ensure the effective application of her rights.
On the basis of all these factors, and in agreement with the other data protection authorities concerned by this processing operation which have been consulted, the following corrective action must therefore be issued against [REDACTED]:
- A REPRIMAND, in accordance with the provisions of Article 58.2. b) of the GDPR and Article 20.II of Law No. 78-17 of 6 January 1978 as amended, with regard to the breach of the obligation to facilitate the exercise of the complainant's rights and to provide information on the measures taken following her initial request, and, on the other hand, the failure to process the request to object to receive marketing and erasure of the complainant's personal data.
Finally, I would like to point out that this decision, which closes the investigation of the complaint, does not preclude the CNIL from using, particularly in the event of new complaints, of all the other powers conferred to it under the law of 6 January 1978 as amended and the GPDR.
CNIL's services (____, legal advisor, Rights and Complaints Department, ____) are available for any additional information.
This decision may be appealed before the French State Council within a period of two months following its notification.
Yours faithfully,
Copy to ____, Data Protection Officer