CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Registered letter with return receipt
Return receipt
President
Investigation of the case:
Paris, 24 OCT. 2023
Our ref: :
Referral no
(to be quoted in all correspondence)
Dear Sir,
I am following up on the various emails exchanged between the CNIL and as part of the investigation into Mr 's complaint, which was forwarded by the German data protection authority for the state of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), pursuant to the cooperation mechanism between European supervisory authorities (Articles 56 et seq. of the General Data Protection Regulation (GDPR)).
As a reminder, lodged a complaint in connection with the difficulties experienced in obtaining the erasure of all his personal data processed by your company. He indicated that he had sent a request to this effect on 17 December 2021, but did not receive a reply.
When asked about this case, the company advised that the complainant's account (linked to the email address) and his personal data were deleted upon receiving his request in December 2021. To substantiate these claims, sent screenshots from its Customer Relationship Management (CRM) software to demonstrate that there were no results after performing a search with the complainant's two email addresses (i.e. the email address linked to his account - - and the email address from which he submitted his erasure request -
The answers provided and the measures taken by to erase the complainant's account and personal data lead me, in agreement with the other European data protection authorities concerned, to close this complaint.
However, I would like to remind you that Article 12(3) of the GDPR provides that the controller (in this case) must respond to requests from data subjects to exercise their rights "without undue delay and in any event within one month of receipt of the request".
I note that a response was only provided to the complainant's erasure request on 24 February 2023 following the CNIL's intervention with , i.e. 14 months after the complainant had
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL
via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
submitted his request to [REDACTED], which constitutes a breach of Article 12(3) of the GDPR.
Consequently, I would like to draw your attention to the need to comply with the response time set out in Article 12(3) of the GDPR for any future requests to exercise rights that your company might receive.
In case of any new complaints, the CNIL reserves the right to use all the powers vested by virtue of the GDPR and the French Data Protection Act of 6 January 1978, as amended.
Yours sincerely,
For the CNIL Chair and on her behalf,
