CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Managing Director
Investigation of the case:
Our ref:
Referral No
(to be quoted in all correspondence)
Paris, October 23, 2023
For the attention of the Chief Executive Officer,
I am writing to you further to the exchanges of emails between the departments of the French data protection authority (hereinafter “CNIL”) and the data protection officer of the company [REDACTED], which took place in the context of the investigation of Mr [REDACTED]’s complaint no. [REDACTED], which was passed onto the CNIL by the personal data protection authority of the German state of Baden-Württemberg, pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (hereinafter “GDPR”).
Firstly, the complainant states that he encountered difficulties in exercising his right to erasure of his personal data with [REDACTED] (1).
He has indicated that he requested the deletion of personal data concerning him via the contact form on the [REDACTED] de website. He specified that the support team acknowledged receipt of his request for erasure in the email of 27 June 2022, but that the deletion of his personal data had not been confirmed.
As part of his complaint, Mr [REDACTED] also stated that the [REDACTED] de website would allow data subjects to deactivate their account but not delete it (2).
1. Regarding the difficulties encountered by Mr [REDACTED] in exercising his right to erasure of his personal data with [REDACTED]:
As part of its discussions with the CNIL, [REDACTED] first confirmed that it had deleted Mr [REDACTED]’s personal data from its database. [REDACTED] sent the CNIL a screenshot of its database attesting to the erasure of Mr [REDACTED]’s data.
Then, the company confirmed that, when Mr [REDACTED] exercised his right to erasure, the procedure for handling erasure requests involved sending two separate emails to the data subjects: a first email was intended to confirm receipt of the request and a second email was intended to inform the data subject of “the implementation” of the erasure procedure. However, due to a “human and isolated error”, the company acknowledged that Mr [REDACTED] did not receive the second email confirming the erasure of his personal data. Since this occurred, the company has indicated that it has changed its procedures and that “now a single email is automatically sent (to avoid human errors) to the user as soon as the data deletion procedure is implemented in order to inform them of the measures taken following their request, in accordance with the terms of Article 12.3 of the GDPR”.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 – 75334 PARIS CEDEX 07 – 01 53 73 22 22 – www.cnil.fr
Les données personnelles nécessaires à l’accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s’adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
Consequently, it emerges from these elements that the personal data concerning Mr [REDACTED] has been deleted by [REDACTED] and that the procedure for managing erasure requests has been modified in order to avoid the occurrence of other human errors in the future.
2. With regard to the fact that the [REDACTED] de website will allegedly allow data subjects to deactivate their account but not delete it:
On this point, [REDACTED] indicated that, firstly, members of the [REDACTED] platform have the possibility of closing their account themselves by logging into their personal space.
Secondly, [REDACTED] stated “that account closure results in the application of [its] procedure for deleting personal data, in accordance with [its] data retention policy”. Thus, when the holders of a [REDACTED] account initiate the account closure procedure accessible from their personal space, their personal data is automatically deleted at the end of this procedure.
As a result, it emerges from these facts that the [REDACTED] de website offers data subjects the possibility of deleting their account.
For this reason, the responses provided by [REDACTED] lead me, in agreement with the other European data protection authorities concerned by the processing of your personal data, to close this complaint.
However, in case of new complaints, the CNIL reserves the right to use all the powers vested by virtue of the GDPR and the French Data Protection Act of 6 January 1978, as amended.
Yours sincerely,
For the CNIL Chair and on her behalf,
Department for the exercise of rights and complaints
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 – 75334 PARIS CEDEX 07 – 01 53 73 22 22 – www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.