¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Registered letter with acknowledgement of receipt
No. AR :
File processing:
N/Ref.:
Complaint No.
(to be included in all correspondence)
Paris, on
Mr president,
I am following up on the e-mail exchanges that have taken place between the services of the Commission Nationale de l'Informatique et des Libertés (CNIL) and [REDACTED]'s data protection officer, as part of the investigation of Mr [REDACTED]'s complaint forwarded by the German Data Protection Authority of the Land of Berlin (Der Berliner Beauftragte für Datenschutz und Informationsfreiheit), in application of the mechanism for cooperation between European authorities pursuant to Articles 56 et seq. of the General Data Protection Regulation (GDPR).
As a reminder, the complainant lodged a complaint against the company [REDACTED] relating to a security and confidentiality issue in the processing of his personal data. On 19th September 2019, the complainant indicated that he had received an e-mail from [REDACTED] on his e-mail address ([REDACTED]), giving the surname, first name, telephone number and e-mail address of a third party.
In the exchanges that took place between the CNIL services and [REDACTED]'s data protection officer, by e-mails of 26th November and 18th December 2020, it was indicated that this disclosure of personal data would be the consequence of an internal human error.
It was specified that following the intervention of the CNIL services in the case of such a disclosure, [REDACTED] notified the personal data breach to the data subject.
These facts lead me to remind you that, it is your responsibility as data controller to:
- ensure compliance with Article 5(1)(a) of the DGPD, by ensuring that personal data are processed lawfully, fairly and in a transparent manner ;
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL
via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
- implement, taking into account the nature, scope, context and purposes of the processing, as well as the varying degrees of risk to the rights and freedoms of natural persons, the appropriate technical and organizational measures to ensure and to be able to demonstrate that processing is performed in accordance with the Article 24(1) of the GDPR ;
- in the event of a personal data breach, to notify the CNIL of the breach without undue delay and, if possible, no later than 72 hours after having become aware of it in accordance with Article 33 of the GDPR. As part of its security obligations, the data controller shall set up a procedure to manage personal data breaches, with the aim of preventing, detecting and reacting appropriately to limit the risks and avoid future breaches.
You will find more information on these subjects on the CNIL website:
https://www.cnil.fr/fr/les-violations-de-donnees-personnelles
https://www.cnil.fr/fr/notifier-une-violation-de-donnees-personnelles
Given the answers provided and the measures adopted, and having no doubt that has since taken the necessary measures to ensure the security of its processings, in agreement with the other European data protection authorities concerned, I hereby inform you that I am closing this complaint.
In the event of further complaints, the CNIL reserves the right to use all the powers granted to it by the GDPR and the amended Act of 6th January 1978.
Yours sincerely
For the President of the CNIL and by delegation
Subject to the applicant's right to bring an action, CNIL decisions may be appealed to the Conseil d'Etat within two months of their notification, extended by:
- one month for residents of Guadeloupe, French Guiana, Martinique, Réunion, Saint-Barthélemy, Saint-Martin, Mayotte, Saint-Pierre-et-Miquelon, French Polynesia, the Wallis and Futuna Islands, New Caledonia and the French Southern and Antarctic Territories;
- two months for people living abroad.