¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
CNIL
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Registered letter with acknowledgement of receipt
No. AR:
File processing:
Ref:
Complaint No:
(to be included in all correspondence)
Paris, on 18th September 2024
Mr president,
I am following up on the exchanges that have taken place between the services of the Commission nationale de l'informatique et des libertés (CNIL) and those of , as part of the investigation of Mrs s complaint forwarded by the Spanish Data Protection Authority (Agencia Española de Protección de Datos), in application of the mechanism for cooperation between European authorities pursuant to Articles 56 et seq. of the General Data Protection Regulation (GDPR).
As a reminder, the complainant lodged a complaint against the company regarding the unsolicited receipt of direct marketing mail at her postal address. The complainant claims that she had no contractual relationship with this company and that she did not provide any contact details.
In the first place, with regard to the source of the complainant's personal data, the exchanges that took place between the CNIL and by letters of 30th November and 24th December 2021, revealed the following.
First of all, points out that the complainant does not appear in its own customer database, insofar as she has never ordered products or taken part in the advertising games that enable the company to collect the personal data of prospective customers.
Furthermore, states that it wished to canvass prospective customers. To do so, the company called on the services of which rented out its database of prospective customers.
However, it appears that the complainant's personal data were included in the database of insofar as the complainant, who has been a regular customer of since 2012, consented in 2017 to the use of her personal data for direct marketing purposes by third-party partners, including . A supporting document was provided by to attest to its consent to receive direct marketing from partners of
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles
Lastly, [REDACTED] adds that it has contacted the complainant only once for direct marketing purposes.
In the second place, with regard to the complainant's right to object request, I take note that [REDACTED] states that it has stopped using her personal data for direct marketing purposes and has informed [REDACTED] accordingly.
In any event, in the future, I would draw your attention to the necessity for [REDACTED] to provide information to data subjects whose personal data are collected indirectly, in this case through its commercial partners, as soon as possible (in particular during the first contact with the person) and within one month at the latest.
In this respect, in accordance with Article 14 of the GDPR, the identity and the contact details of the controller, the purposes of the processing, the categories of personal data concerned, the existence of a transfer of data to a recipient in a third country or an international organisation, the period for which the personal data will be stored, the rights of data subjects conferred by the GDPR, the right to lodge a complaint with a supervisory authority and the existence of automated decision-making must all be indicated. In addition, the source of the personal data collected must be indicated to the data subjects.
Given the answers provided and having no doubt that [REDACTED] has since taken the necessary measures to ensure the compliance of its processings, in agreement with the other European data protection authorities concerned, I hereby inform you that I am closing this complaint.
In the event of further complaints, the CNIL reserves the right to use all the powers granted to it by the GDPR and the amended Act of 6th January 1978.
Yours sincerely
For the President of the CNIL and by delegation,
Subject to the applicant's right to bring an action, CNIL decisions may be appealed to the Conseil d'Etat within two months of their notification, extended by:
- one month for residents of Guadeloupe, French Guiana, Martinique, Réunion, Saint-Barthélemy, Saint-Martin, Mayotte, Saint-Pierre-et-Miquelon, French Polynesia, the Wallis and Futuna Islands, New Caledonia and the French Southern and Antarctic Territories;
- two months for people living abroad.