CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Investigation of the case:
Our ref.:
Referral No.
(to be quoted in all correspondence)
Paris, 9th January 2024
Dear Sir,
I am writing in response to the exchange of emails between the services of the Commission nationale de l'informatique et des libertés (CNIL) French DPA and the Data Protection Officer of [REDACTED], as part of the investigation of the complaint sent to us by the Polish Data PAuthority, pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (hereinafter "GDPR").
The claim concerned the difficulties experienced by Mr [REDACTED] relating to:
1. the processing of personal data concerning him carried out by your company;
2. and the difficulties he experienced with your company in exercising his right to the erasure of his personal data.
The complainant stated that he had never shared his data with your company, and was therefore unaware of how it had obtained this data. In addition, despite having sent by email, on 4th August 2022, a request to erase his data, and having received, on 12th August, an email confirming that his request had been duly processed, he specified that he continued to receive emails from the [REDACTED] (by providing as an attachment, in support of his complaint, a zipped file including six emails received from your company between 12th August 2022 and 3rd January 2023).
1/ With regard to your processing of personal data concerning Mr [REDACTED]:
I have noted the fact that the processing of Mr [REDACTED]' email is the result of an isolated error, as it was mistakenly recorded in your business software by an employee of the [REDACTED], and liked to the file of a namesake.
2/ Regarding the difficulties encountered by Mr [REDACTED] in exercising his right to the erasure of his personal data with your company:
I have noted the fact that his request for erasure had indeed been processed by the [REDACTED], in accordance with the confirmation email that was sent to him on 12th August 2022 but that a
REPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
The personal data required to perform the CNIL's missions are stored and processed in files intended for its exclusive use. Data subjects may exercise their data protection rights by contacting the CNIL Data Protection Officer via an online form or by post.
technical update of your IT systems, which took place in October 2022, nevertheless caused the unplanned reactivation of proposals for temporary assignments sent to the complainant. I have taken note of the actions subsequently taken, since following the discovery of this error, the complainant's email was permanently deleted from your database and the temporary worker's record was duly corrected in your database.
In addition, I note that the [REDACTED] branch network has since been instructed to comply with the updating of the personal data of the data subjects and the final processing of their requests to exercise rights in order to minimise any risk of human error.
For this reason, the isolated nature of this case, and the responses and actions provided by [REDACTED] lead me, in agreement with the other European data protection authorities concerned by your processing, to close this complaint.
However, the CNIL reserves the right, in the event of new complaints, to make use of all the powers granted to it under the provisions of the GDPR and Law No. 78-17 of 6th January 1978 as amended on data processing, files and freedoms.
Yours sincerely,
For the CNIL Chair and on her behalf,
