Registered letter n°
File processing: Paris, 4th September 2024
N/Ref:
Referral
(to be included in all correspondence)
Dear Mr. ,
I am writing further to the exchange of e-mails between the services of the Commission nationale
de l'informatique et des libertés (hereinafter "the CNIL") and the Data Protection Officer of the
(hereinafter "the ") as part of the investigation of the complaint
sent to us by the personal data protection authority of the German federal state of Mecklenburg-
Western Pomerania ("Der Landesbeauftragte für Datenschutz und Informationsfreiheit
Mecklenburg-Vorpommern"), pursuant to the provisions of Article 56.1 of the General Data
Protection Regulation (hereinafter "GDPR").
This complaint concerned the difficulties encountered by Ms in exercising her
right of access to her personal data processed by .
The complainant stated that, in response to her request for access to a copy of her personal data,
made by e-mail on 22 June 2023, she had received a reply by e-mail on 30 June 2023 containing, as
an attachment, a document in PDF format containing personal data about her, including an
unredacted copy of her identity card, transmitted unencrypted. This email was also sent to two people,
in carbon copy, one apparently working for your institution, the other working as an Erasmus
coordinator for the (Mecklenburg-Western Pomerania).
The complainant argued that the reply she received should not have included a third party and
that the copy of her identity document that she had provided should have been deleted no later than
on the date on which the Erasmus exchange that had been planned with your organisation was
cancelled.
She added that the data provided in response to her request seemed incomplete: in fact, as her
correspondent within your organisation had told her that he wished to clarify a specific question
concerning her internally, emails or, at the very least, internal notes or other elements, should have
been processed or stored for this purpose and, consequently, included in the copy of her data sent.
Finally, she pointed out that the copy did not contain all the information mentioned in Article 15(1)
of the GDPR.
1. With regard to the retention of the complainant's identity document:
I have noted that the application process for an Erasmus exchange within your organisation
includes the provision of a copy of the identity document, which has led, by deduction and habit, to
this document being perceived as part of the application file. You indicate that the retention period
for this element, for rejected applications, was set at one year, whereas in view of the intended
purpose, the copy of the identity document should only be retained for the time necessary to verify
the identity of the applicant and the accuracy of the data concerned, before being deleted. I have
noted that your organisation's Data Protection Officer has asked the data controller (in this case,
's Department) to delete the copies of the identity cards concerned.
I would also point out that, if Ms 's identity card was kept for longer than was
strictly necessary, it would in any event have been deleted the following year.
2. With regard to the inclusion, in the above-mentioned e-mail of 30th June 2023, of
two third parties :
I have taken note of the explanations given by your organisation's Data Protection Officer,
according to which were carbon-copied in the response to Ms 's request for access:
1) the Head of the International Relations Department, for her information and follow-up
of this request, by virtue of her function and, in this case, as data controller, as well as
2) the person responsible for coordinating the Erasmus programme at the complainant's home
university.
In this respect, I also take note of the fact that, while the inclusion of the latter does indeed
constitute an accidental transmission constituting a breach within the meaning of the GDPR, the
degree of this breach remains low: firstly, the data concerned is used solely for academic purposes
and does not constitute sensitive data, and secondly, the recipient is an agent responsible for
managing the complainant's mobility in her home institution, bound by an obligation of discretion
and professional secrecy in the performance of his duties and who does not constitute a "malicious
actor".
Finally, I note that the CNIL was notified of this breach, following its intervention, and that the
unauthorised recipient of the complainant's data was asked to delete the disputed email, which he
confirmed in writing.
I have also noted that, since these exchanges, the staff concerned have been reminded of the need
to involve the Data Protection Officer in all matters relating to data protection, including requests to
exercise rights, in order to secure their processing, and a working meeting has been scheduled with
the Department to examine the precautions to be taken to avoid any similar
incident.
I also note that the above-mentioned data breach did not have a significant effect on the data
subject and is not one of the breaches likely to give rise to a risk or a high risk that must be notified
to the Data Protection Authority (see Guidelines 01/2021 on Examples of Personal Data Breach
Notification adopted on 14 December 2021 in its version 2.0).
3. Regarding the response to Ms 's request for access:
I have noted that a further response was sent to the complainant by two emails dated 8 April 2024
which complied with the requirements of Article 15 of the GDPR and included a secure download
link which enabled the complainant to download a copy of her personal data.
I would also point out that the complainant's request for access was initially partially dealt with
within the time allowed.
In this context, the responses provided by and the measures taken to respond to the
complainant's request and to prevent a repetition of the facts that are the subject of her complaint
lead me, in agreement with the other European Data Protection Authorities concerned by your
processing operations, to close this complaint.
However, the CNIL reserves the right, in the event of further complaints, to make use of
all the powers conferred on it by the provisions of the GDPR and Act no. 78-17 of 6th January 1978,
as amended, relating to data processing, data files and individual liberties.
Yours sincerely,
For the Chair of the CNIL, and by delegation,