CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The Chair
Chief Executive Officer
Investigation of the case:
Paris, October 5, 2023
Our ref:
Referral No.
(to be quoted in all correspondence)
Dear Sir,
I am following up on the various exchanges between the departments of the Commission Nationale de l'Informatique et des Libertés ('CNIL' - French Data Protection Authority) and [REDACTED]'s Data protection officer (the 'DPO') as part of the investigation of Mr [REDACTED]'s complaint, referred to the CNIL by the SA North Rhine-Westphalia Data Protection Authority ('Lander Commissioner for Data Protection and Freedom of Information') pursuant to Article 56.1 of the General Data Protection Regulation ('GDPR').
# I. Background to the complaint and events
Mr [REDACTED] has filed a complaint with his national data protection authority against [REDACTED] concerning, firstly, the difficulties encountered in exercising his rights, and secondly, the methods for processing data via the [REDACTED] platform.
The complainant stated that he applied, in April 2019, whose offer was published in German on [REDACTED] for a position on this platform, and in May 2020, found that all his documents (CV, etc.) were still present and accessible in his account on this platform. He said that he tried to delete his online account but that this was not possible.
The complainant explained that he then exercised his right of access but was unable to obtain the information requested within one month and had difficulties in actually accessing his data because the answers provided were in English in addition to being fragmented. He added that the information about the possibility of contacting a data protection authority to file a complaint was also missing.
The complainant mentioned that the data processing related to the [REDACTED] platform is not carried out in accordance with the principle of transparency. According to him, [REDACTED]'s Data protection officer in Germany cannot be reached.
Finally, the complainant stated that the data was collected as part of a fictitious job advertisement and that the data was thus intended to be used for other purposes (other vacancies than that of the advertisement, marketing and profiling) without data subjects' consent being legitimately obtained and that as such, the data was retained beyond the period for reviewing his application.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
## II. Analysis of the relevant facts
# 1. Breach of the obligation of transparency of information and communications and procedures for the exercise of the data subject's rights
Firstly, Article 12.1 of the GDPR stipulates that the data controller shall take appropriate measures to make any communication to the data subject, in particular under Article 15 of the GDPR, in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
In this case, [REDACTED] informed the CNIL that the response given to the complainant on 1 July 2020 had not been in German but in English because the various exchanges with the complainant showed that he had a very good level of English. However, the company stated that this response did include the relevant excerpts from the Privacy Policy in German thus responding to the complainant's questions about the conditions for processing his personal data.
Yet, regardless of the applicant's situation, the data controller must respond to requests for exercising rights by ensuring that the responses provided are intelligible and easily accessible, which means providing a response in the applicant's language.
Secondly, under the provisions of Article 12.3 of the GDPR, the data controller is required to respond to the individual who submits a request pursuant to Articles 15 to 22 of the GDPR, indicating the action taken as a result of their request as soon as possible "and in any event within one month of receipt of the request".
In this case, I note that the response to the complainant's request for access on 19 May 2020 was given on 1 July 2020, which is a little more than 10 days late. The CNIL has been informed that the reason for this delay was that the process for handling requests for deletion and access involved manual action at that time.
I note the fact that the process for handling requests for deletion and access rights is now automated and results in an automatic response to the data subject within the time limit set.
However, I consider that [REDACTED] disregarded the provisions of Article 12(1) and (3) of the GDPR by not communicating as provided for under Article 15 of the GDPR with the data subject in the language used in his request and within the time limit of one month of the receipt of that request.
# 2. Breach of the data subject's right of access
Under Article 15(1) of the GDPR, the data subject shall have the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data as well as certain information on the processing carried out.
In this case, when questioned about the management of the access request exercised by the complainant, your services informed the CNIL that it understood that his initial wish was to delete his data from the platform due to the rejection of his application. His data was thus deleted from the platform, and it is therefore no longer possible to send him a copy of his data as part of an access request, as the deletion of the data is permanent.
However, in his access request, although the complainant mentioned the fact that he was unable to delete his personal data from the platform, he nevertheless explicitly indicated that his action was aimed at exercising his right of access.
In addition, irrespective of the general information on the processing, it was up to [REDACTED] to explicitly highlight the information on the possibility of filing a complaint with a supervisory authority in its response to the complainant.
Thus, I consider that [REDACTED] disregarded Article 15(1) of the GDPR by not providing the personal data requested by the complainant in accordance with his request.
### III. Corrective action imposed by the CNIL (Article 58(2) GDPR)
Due to the breaches identified, and in agreement with the other data protection authorities concerned by this processing, the following corrective measures must be imposed against [REDACTED]:
- A LEGAL REPRIMAND, under the provisions of Article 58(2)(b) of the General Data Protection Regulation and Article 20.II of French Data Protection Act No. 78-17 of 6 January 1978.
Lastly, I would like to point out that this decision, which closes the investigation of Mr [REDACTED]'s complaint, does not exclude the CNIL from making use of all the other powers granted to it by the GDPR and by the Act of 6 January 1978 as amended, particularly in the event of new complaints.
The CNIL's services ([REDACTED], lawyer advising on the exercise of rights and complaints, [REDACTED]) are available to you for any additional information.
This decision may be appealed before the State Council within two months of its notification.
Yours faithfully,