CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Registered letter with acknowledgement of receipt
No. AR:
For the attention of the president
File processing:
Paris, on
08 AOÛT 2024
Ref:
Complaint No.
(to be included in all correspondence)
Mr president,
I am following up on the e-mail exchanges that have taken place between the services of the Commission Nationale de l'Informatique et des Libertés (CNIL) and [REDACTED]'s data protection officer, as part of the investigation of Mr [REDACTED]'s complaint forwarded by the Spanish Data Protection Authority (Agencia Española de Protección de Datos), in application of the mechanism for cooperation between European authorities pursuant to Articles 56 et seq. of the General Data Protection Regulation (GDPR).
As a reminder, the complainant lodged a complaint about the difficulties encountered in obtaining the erasure of all the personal data concerning him processed by your company.
Discussions between the CNIL and [REDACTED]'s data protection officer, by letters of 15th June and 13th July 2021, revealed the following.
With regard to the first request made by the complainant, you stated that the lack of response to this request was due to the fact that the contact address [REDACTED] which appeared on the [REDACTED] website and had been used by the complainant was in fact incorrect.
However, you indicated that in order to avoid this situation, a correction had been made on the website in question to direct users to the contact address [REDACTED] in the section « Who should I contact in the event of a complaint? » and to the [REDACTED]'s data protection officer for France ([REDACTED]), Belgium ([REDACTED]), Italy ([REDACTED]), Portugal ([REDACTED]) and Spain ([REDACTED]).
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
With regard to the complainant's second request for erasure, although the company initially warned him that it would have recourse to the extension of the deadline provided for in Article 12 in order to process the request, the company did reply. The complainant was then informed that the company was obliged to retain his personal data for evidential purposes for a period of 5 years from the termination of the contract (in this case, on 17th January 2020), pursuant to the provisions of article L110-4 of the French Commercial Code and article 17.3.b) of the General Data Protection Regulation.
However, I note that the company proceeded on 4th March 2020 to erase the complainant's data that could have been deleted, in particular his bank details, including his IBAN, and that measures have since been taken to ensure that the complainant's personal data are no longer used for canvassing purposes. I also note that your company has taken due note of its obligations under the provisions of Article 12 in particular, in order to prevent such a situation from recurring.
In view of all these factors, and in agreement with the other European data protection authorities concerned, I am closing this complaint.
In the event of further complaints, the CNIL reserves the right to use all the powers granted to it by the GDPR and the amended Act of 6th January 1978.
Yours sincerely
For the President of the CNIL and by delegation,
Subject to the applicant's right to bring an action, CNIL decisions may be appealed to the Conseil d'Etat within two months of their notification, extended by :
- one month for residents of Guadeloupe, French Guiana, Martinique, Réunion, Saint-Barthélemy, Saint-Martin, Mayotte, Saint-Pierre-et-Miquelon, French Polynesia, the Wallis and Futuna Islands, New Caledonia and the French Southern and Antarctic Territories;
- two months for people living abroad.