Registered letter with acknowledgement of
receipt For the attention of the Chairman
N°AR :
Paris, on February 14th, 2024
CPD Ref.:
Referral No.:
(to be included in all correspondence)
Mr.
As part of the cooperation and consistency mechanism provided for in Chapter VIII of
the General Regulation on the Protection of Personal Data (hereinafter referred to as the
"GDPR") 1 , the Commission Nationale de l'Informatique et des Libertés (CNIL) was asked by
the Irish Data Protection Authority (DPC) to investigate the complaint lodged by Ms
(hereinafter referred to as the "complainant") against (hereinafter
referred to as the "company").
Since the company is based at , France, the
CNIL is competent to act as lead supervisory authority within the meaning of Article 56(1) of
the RGPD.
I. The facts
In the course of her professional activity, the complainant worked with
, a company specialising in linguistic services, as a freelance translator.
By e-mail dated 4 February 2021 to , the complainant
expressed her disagreement with the new pay scale introduced by the company and requested
that all her personal data be erased.
By e-mail dated 5 February 2021, the company acknowledged the complainant's
disagreement but did not respond to her request for erasure.
1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
individuals with regard to the processing of personal data and on the free movement of such data and repealing
Directive 95/46/EC, OJEU L.119.
The complainant therefore repeated her request by e-mail dated 4 March 2021, but this
too remained unanswered.
On 10 March and 9 April 2021, the complainant received two further emails from the
company, the first asking her to provide her tax residence certificate and the second requesting
an urgent translation assignment. The complainant systematically renewed her request for
erasure as soon as she received each of these e-mails.
On 9 April 2021, the company replied to these last two erasure requests via two separate
emails.
With regard to its e-mail of 10 March 2021, the company replied that it had deleted the
complainant's data from its entire information system, including the mailing list of its
accounting department.
With regard to its e-mail of 9 April 2021, the company explained that this new request
was the result of a technical failure and provided the complainant with a copy of her personal
data still in its possession, specifying that it would be used solely for the application of the
collaboration contract between the complainant and the various entities of the company. This
information would be kept for 10 years from the date of her last invoice following the services
she provided to the company as a freelance translator and, during this retention period, would
only be accessible to staff who needed it for administrative or financial purposes.
On 1er June 2021, the complainant received a new e-mail from the company asking her
to provide her tax residence certificate for 2021.
As a result, the complainant lodged a complaint with the DPC regarding the difficulties
she had encountered with the company in exercising her right to erasure and, more specifically,
to find out why some of her personal data was being kept for a period of 10 years from the last
invoice issued following services carried out on the company's behalf.
II. Analysis of the facts
This decision follows the various exchanges that took place between my departments
and those of the company as part of the investigation of this complaint.
In an email dated 18 February 2022, the CNIL interrogated the company and draw its
attention to its obligations as a data controller within the meaning of Article 4.27 of the RGPD.
The CNIL first reminded the company that, pursuant to Article 17(1) of the RGPD, any
person has the right to obtain the erasure of their data from the controller.
The CNIL then explained to the company that when a person exercises his or her right
to erasure, the data controller shall inform the data subject of the measures taken in response to
the request as soon as possible "and in any event within one month of receipt of the request"
(Article 12(3), of the RGPD) and that where no action is taken on this request, the controller
shall inform the data subject without delay, and at the latest within one month, of the reasons
for not taking action and of the possibility of lodging a complaint with a supervisory authority
and seeking judicial remedy (Article 12(4) of the RGPD).
Finally, the CNIL has informed the company that any refusal to grant the data subject's
request shall be justified and should only occur if the processing of the data subject's personal
data is strictly necessary for one of the reasons set out in Article 17(3) of the GDPR, such as
compliance with a legal obligation. While certain data may therefore be retained for the
purposes of the data controller's administrative or tax obligations, it may only be used for these
purposes and the data subject must be duly informed. On the other hand, the erasure requests
for data that is not essential for this purpose shall be granted.
By return dated 8 March 2022, the company first stated that it had identified the source
of the malfunction that had led to the retention of the complainant's personal data. It stated that
the complainant's personal data continued to be stored on a local database of one of its
subsidiaries despite her request for deletion on 4 February 2021. The company confirms that it
has modified its internal procedures for handling erasure requests by introducing a cross-
checking system to ensure that such requests are handled effectively by all group entities and
to prevent similar breaches from occurring in the future. The company then confirmed that it
had erased the complainant's data from all of the group's databases, with the exception of tax
data covered by a legal retention obligation, in accordance with Article 17(3) of the GDPR.
The CNIL forwarded these explanations to the DPC with a view to informing the
complainant. The complainant indicated that she was satisfied with the controller's response
and considered her complaint resolved.
Consequently, in agreement with the other concerned European data protection
authorities that were consulted, I consider that all of these elements have made it possible to
respond to the complainant's request.
It has therefore been decided to close this complaint.
Yours sincerely,
For the CNIL Chair and on her behalf,
Certified copy :
- Mr Group Data Protection Officer