The Chairman
, Chairman
By registered letter no.
File processing: Paris, 8th April 2024
Ref:
Referral N°
(to be included in all correspondence)
Mr. Chairman,
I am following up on the various exchanges that took place between the services of the
Commission Nationale de l'Informatique et des Libertés ("CNIL") and the interim Data Protection
Officer (here- after "DPO") of as part of the investigation of the complaint by Mr
("the complainant"), forwarded to the CNIL by the Norwegian Data Protection
Authority ("Datatilsynet") pursuant to the provisions of Article 56.1 of the General Data Protection
Regulation ("GDPR").
I. Background to the claim and the facts
Mr lodged a complaint with Datatilsynet against , concerning the
difficulties encountered in exercising his right of access to the data collected by his
vehicle.
In his complaint of 15 July 2022, the complainant explained that :
1/ his requests for access, sent to and , have
remained unanswered, apart from an automatic acknowledgement of receipt received on 11 February
2022;
2/ In the absence of any response to his requests, he contacted the CEO of the Norwegian branch
of directly, who sent him data from the application. However, this data did
not correspond to the data collected by his car but traced his activity on this application and included
his contact details and the identification number of his vehicle;
3/ during exchanges with the CEO of the Norwegian branch of , the latter
provided him with the car's manual stating that the car "does not collect personal data that cannot be
deleted" and "whether or not you decide to stop sharing, the vehicle's usage data is sent to the
manufacturer and the relevant partners/suppliers for the following purposes", without answering his
questions regarding the nature of the data collected by his vehicle;
4/ the CEO of the Norwegian branch of then sent him, on 21 June 2022, an
e-mail indicating that technical data was being collected from the battery. After investigation, it
appeared that this e-mail had been sent to the complainant by mistake, as it was a message sent by the
services of the Dutch branch of to a third party.
The CNIL has contacted to ask about the facts brought to their attention.
In response, informed the CNIL that the request sent on 11 February 2022 to
had not been identified and processed as a request to exercise rights, due to a
temporary malfunction linked to an internal reorganisation.
It pointed out that the Norwegian branch of , which is an independent importer,
had had difficulty understanding the questions asked by the complainant and identifying them as a
request for right of access, which had led to a delay in dealing with his request.
indicated that its request for access had now been satisfied.
Discussions with have led me to identify the following points.
II. Analysis of the facts
1. Failure to comply with the obligation of transparency of information and communications
and the procedures for exercising the rights of the data subject
Pursuant to the provisions of Article 12 of the GDPR, the controller must take appropriate
measures to provide any communication to the data subject, in particular under Article 15 of the GDPR,
in a concise, transparent, comprehensible and easily accessible manner and in clear and simple terms,
while facilitating the exercise of the rights conferred by the GDPR (Articles 12.1 and 12.2 of the
GDPR).
In addition, it is obliged to respond to the data subject who has made a request for access as
soon as possible "and in any event within one month of receipt of the request" (article 12.3 of the RGPD).
In this case, indicated that the requests sent on 11 February 2022 to the address
and then to the Norwegian branch of had not been identified and
processed as a right of access request. It specified that some forty emails, sent between April 2022 and
January 2023, had been necessary to clarify and respond to the request made by the complainant.
stated that the information requested had been sent to the complainant in June and
October 2022, then in January and April 2023.
However, I note that the complainant made his request to two functional addresses
( and ) and that he only received an
acknowledgement of receipt from the first address. In addition, it appears that it was only by taking the
initiative to contact the CEO of the Norwegian branch of directly that the complainant
obtained, in a staggered manner, responses to his request for access, even though it was made as early
as 11 February 2022.
Consequently, I consider that has failed to comply with the provisions of
Article 12(1) to (3) of the GDPR, by not taking the appropriate measures to provide the communication
required under the provisions of Article 15 of the GDPR to the data subject within the stipulated period
of one month from receipt of the request, and by not facilitating the exercise of the data subject's right
of access.
2. Failure to respect the data subject's right of access
Pursuant to Article 15 of the GDPR, the data subject has the right to obtain from the controller
confirmation as to whether or not personal data relating to him or her are being processed and, where
they are, access to such personal data, as well as certain information about the processing carried out.
In this case, although the complainant had specified in each of his requests that he wished to
obtain access to his personal data, the company did not grant his request for access, providing him only
with data and information from the user manual, without answering his questions about the nature of
the data collected by his vehicle.
The investigation of this case also showed that the answers provided to the complainant did
not include all the information required under Article 15 of the GDPR, in particular the possibility of
lodging a complaint with a supervisory authority, the recipients and categories of recipients of personal
data, in particular those established in third countries, and the appropriate safeguards put in place under
Article 46 of the GDPR.
Consequently, I consider that has failed to comply with the provisions of
Article 15(1) to (3) of the GDPR, by not communicating the personal data requested by the complainant
in accordance with his request, as well as the information required by these provisions.
III. Corrective measure ordered by the CNIL (article 58-2 of the GDPR)
In view of the shortcomings identified, and in agreement with the other personal data protection
authorities in the European Union concerned by these processing operations, the following corrective
measure should be imposed on :
- A REPRIMAND, in accordance with the provisions of article 58.2.b) of the General Data
Protection Regulation and article 20.II of law no. 78-17 of 6 January 1978 as amended
relating to information technology, files and freedoms.
This decision takes into account the fact that, since the CNIL's intervention, the complainant's
request for access has been granted.
In accordance with Article 77 of the GDPR, Mr , the author of the complaint
at the origin of this file, has been informed of this decision.
Please note that this decision, which concludes the investigation of this complaint, does not
preclude the CNIL from using all the other powers conferred on it by the provisions of the GDPR and
the aforementioned amended Act of 6 January 1978, particularly in the event of new complaints.
The CNIL (
will be happy to provide any further information you may require.
This decision may be appealed to the Conseil d'Etat within two months of notification.
Yours sincerely
Marie-Laure DENIS
Copy sent to: Mr ( ), Acting Data Protection
Officer for , and , Data Protection Officer for