CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Dear Sir,
This letter follows the exchange of emails between the departments of the Commission nationale de l'informatique et des libertés (French Data Protection Authority, CNIL) and the data protection officer (DPO) of [REDACTED] in connection with the investigation of the complaint sent to us by the Berlin data protection authority, pursuant to the provisions of article 56.1 of the General Data Protection Regulation (hereinafter "GDPR").
More specifically, the complaint concerned the difficulties encountered by Mr [REDACTED] in exercising his rights of access and erasure of personal data concerning him and held by [REDACTED]
# I. Reminder of the complaint and the facts
In 2017, Mr [REDACTED] purchased a bus ticket on a website using the [REDACTED] payment solution. He states that he then immediately requested the erasure of his personal data, as well as the deletion of his [REDACTED] account (automatically created during an online purchase) on 3 September 2017. On 4 September 2017, the departments of [REDACTED] confirmed to him the "closure/cancellation" of his account ([REDACTED] wallet account closed/cancelled).
On 15 May 2019, when purchasing another bus ticket on the same website, he was informed that the online transaction could not be completed because his account, linked to both his email address and his credit card number, had been deactivated.
Noting that his data was in fact still being processed by [REDACTED] he filed a request for access to his personal data on 3 June 2019. On the same day, [REDACTED] provided a response to the complainant, simply stating that the only data retained were the [REDACTED] account number, the first six numbers and the last four numbers of the credit card, and the complainant's email address, for a period of five years in accordance with the legal obligations applicable to financial institutions.
In response, the complainant again requested the erasure of his data on 7 June 2019 and the contact details of the company's DPO to ensure the processing of his request. On 17 June 2019, [REDACTED]
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant ou délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
■s customer service department ("■Customer Care") confirmed that it had deleted his banking data, with the exception of his email address and transaction history, without providing him with the contact details of its DPO.
This is the context in which the complainant filed a complaint with the Berlin data protection authority.
During the investigation of the complaint by the CNIL, on 4 January 2021, ■ceased to exist, having been absorbed by ■Aware of the grievances raised by the complainant, ■informed the CNIL that it would contact the complainant to inform him of the previous measures taken by ■concerning the processing of his requests. The complainant subsequently exercised his right of access on 22 July 2022 with ■and stated that the response obtained was unsatisfactory.
He mentioned that it did not contain information on the contact details of the data controller or the data protection officer, and did not mention the right to file a complaint with a supervisory authority. In view of the response obtained to this access request, the complainant also queried the validity of the retention period of his data set at five years.
# II. Analysis of the facts in question
With regard to the complainant's first requests to exercise rights made in 2017 and 2019, it was noted that given the absorption of ■by ■on 4 January 2021, ■was not the data controller at that time.
With regard to the processing carried out by ■from 4 January 2021, it has been noted that it only processes Mr ■s data for the sole purpose of complying with the legal obligation to combat money laundering and the financing of terrorism arising from Directive (EU) 2018/843 of 30 May 2018 amending Directive (EU) 2015/849 and article L561-12 of the French Monetary and Financial Code. In accordance with these provisions, this data was deleted on 3 September 2022.
As such, the processing of Mr ■s data by ■appears to comply with its legal obligations, including with regard to their retention period.
With regard to the request for right of access made by the complainant to ■on 22 July 2022, as noted by the complainant, the CNIL was able to find that ■had not, in its response to the complainant of 5 August 2022, explicitly informed the latter of the ability to file a complaint with a supervisory authority, which constitutes a breach of article 15.1.f) of the GDPR.
These facts were brought to the attention of ■which took the following measures to bring its processing into compliance:
- Inclusion, in addition to the existing reference to the privacy policy which mentions the contact details of the data controller, of explicit information recalling the ability to file a complaint with a supervisory authority, in the responses sent to data subjects who have exercised their rights;
- It should be noted that a dedicated address (email and postal) is accessible to the public on its website (privacy policy), which allows data subjects to exercise their rights.
In addition, it is noted that since the deletion of Mr. [REDACTED]'s data on 3 September 2022, only his data relating to requests to exercise rights are currently kept for a period of five years from the last communication with the data subject.
On this point, it is noted that [REDACTED] has set the retention period for this data within the limit of the statute of limitations for civil action (five years) for the purpose of maintaining evidence, in accordance with the recommendations of the CNIL.
In this context, the measures deployed and the responses provided by [REDACTED] lead me, in agreement with the other European data protection authorities concerned by your processing, to proceed with the closure of this complaint.
However, the CNIL reserves the right, in the event of further complaints, to make use of all the powers granted to it by the provisions of the GDPR and Act No. 78-17 of 6 January 1978 as amended on information technology, files and freedoms.
Sincerely,
On behalf of the President of the CNIL, and by delegation,