CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Investigation of the case:
(to be quoted in all correspondence)
Paris,
October 23, 2023
For the attention of the Chief Executive Officer,
I am writing to you further to the exchanges of emails between the departments of the French data protection authority (hereinafter “CNIL”) and the data protection officer of the company [REDACTED], which took place in the context of the investigation of Mr [REDACTED] complaint no. [REDACTED] which was passed onto the CNIL by the data protection authority of the German state of Baden-Württemberg, pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (hereinafter “GDPR”).
The complainant states that he encountered difficulties in exercising his right to erasure of his personal data with [REDACTED]
He has indicated that he requested the deletion of his account and his personal data by [REDACTED] in an email sent on 19 October 2022 to [REDACTED]. He states that he has not received any response to this email and therefore sent a second email to the same address on 2 November 2022 to obtain confirmation of the erasure of his personal data. He states that [REDACTED] has not replied to this second email either.
As part of its discussions with the CNIL departments, [REDACTED] first confirmed the deletion of [REDACTED]’s personal data and that an email was sent to him on 17 May 2023. [REDACTED] sent the CNIL a screenshot of its database attesting to the erasure of [REDACTED] data.
Then, [REDACTED] stated that it was not aware of [REDACTED] request before the intervention of the CNIL insofar as the complainant sent his request for erasure to an email address (suppor [REDACTED]) that had no longer been used by [REDACTED] since November 2019, i.e. three years before the complainant’s request. The company specifies that, as of November 2019, a new general address [REDACTED] has been put in place and that all of the company’s communication media, including the general conditions of use and the data protection policy, have been updated accordingly.
[REDACTED] adds that, when setting up the new address, it had not considered it necessary to implement an automatic message which would inform the persons sending emails to the address suppor [REDACTED] that the address was no longer used since it was no longer mentioned in its communication media.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 – 75334 PARIS CEDEX 07 – 01 53 73 22 22 – www.cnil.fr
Les données personnelles nécessaires à l’accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s’adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
However, I note that, as soon as [REDACTED]'s departments were informed of [REDACTED] claim, the support [REDACTED] email address was disabled, so that "any users that do use it [will now receive] an automatic reply informing them that the email address has been deactivated".
[REDACTED] also indicated that it discovered, following its first exchanges with the CNIL, that the support [REDACTED] address was "listed by a German third-party website [REDACTED] not belonging to the [REDACTED] group".
I note that [REDACTED] contacted this third-party website in order for the inactive address to be deleted.
Beyond the actions already taken by [REDACTED] to prevent new emails being received by an unused address, I draw your attention to the fact that it is [REDACTED]'s responsibility to also review all the emails it has received on the support [REDACTED] address between the cessation of use of this address in November 2019 and its deactivation following the intervention of the CNIL in order to ensure that all requests for erasure and, more generally, all requests based on the GDPR that may have been made via this address are taken into account.
That being said, the responses provided by [REDACTED] lead me, in agreement with the other European data protection authorities concerned by the processing of your personal data, to close this complaint.
However, in case of new complaints, the CNIL reserves the right to use all the powers vested by virtue of the GDPR and the French Data Protection Act of 6 January 1978, as amended.
Yours sincerely,
For the CNIL Chair and on her behalf,
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 – 75334 PARIS CEDEX 07 – 01 53 73 22 22 – www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.