The President
Paris, 15 November 2024
By recorded delivery letter No […]
By email to the DPO: […]
References to be stated in all correspondence:
Our ref.:
Mr President
In accordance with Decision No 2022-177C of 29 September 2022, the CNIL carried out, on
24 November 2022, an online inspection mission of the website, and on 13 December
2022 an onsite inspection mission at the premises of located at
.
The purpose of these inspections was to verify the company’s compliance with all the provisions
of the amended Act of 6 January 1978 (“Loi Informatique et Libertés”) and Regulation (EU) 2016/679
of the European Parliament and of the Council of 27 April 2016 (GDPR).
The company produced additional information on 22 December 2022 and 13 January 2023.
The CNIL found that was dissolved without liquidation and absorbed by .
By emails of 28 February and 9 April 2024, the company responded to the additional requests
made by the delegation on 13 February and 21 March 2024. The company thus informed the delegation
that the “ website was no longer used, and that no customer account had been
transferred to However, the company informed the inspection delegation in its response of
13 February 2024 that the " table, which is the users’ table for the connection to the
customer account, is kept by .
On 11 September 2024, as part of the cooperation procedure, a draft decision was submitted to
the authorities concerned on the basis of Article 60 GDPR.
This draft did not give rise to any relevant and reasoned objections.
1
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 – 75334 PARIS CEDEX 07 – 01 53 73 22 22 – www.cnil.fr
Les données personnelles nécessaires à l’accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s’adressant au délégué à la protection des données (DPO)
de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
The answers provided by the company lead me to note the following elements.
Analysis of the facts in question
Pursuant to Article 5(1)(e) of the Regulation, “personal data must be […] kept in a form which permits
identification of data subjects for no longer than is necessary for the purposes for which the data are
processed”.
In the case in point, the delegation was informed that kept the database entitled
" ", which is the connection table for users to their customer account on the
“ ” website. However, in its response of 9 April 2024, the company indicated that it had
removed the possibility for customers of logging into their account on the “ ” website.
thus does not justify the need to maintain a database enabling the connection to a customer
account which is no longer possible, especially since no customer account has been transferred from
to .
The company should therefore draw the consequences of this failure, insofar as the retention of the
“ ” database is not justified.
It follows from these elements that disregarded the provisions of Article 5(1)(e) GDPR.
These facts justify a reminder to of its legal obligations.
Corrective measure issued by the CNIL (Article 58(2) GDPR)
Due to all these elements, it is therefore necessary to order the following corrective measure against
:
- A REPRIMAND TO THE CONTROLLER, in accordance with the provisions of Article
58(2)(b) of the General Data Protection Regulation and Article 20.II of the Law of 6 January 1978 as
amended, with regard to the breach of retention periods.
I would point out that this decision does not preclude the CNIL from using all the other powers
conferred on it by GDPR and the amended Act of 6 January 1978, particularly in the event of complaints.
The Commission’s departments (the Sanctions and Litigation Department registry –
(01.53.73.22.41/22.53/22.64 or [email protected]) are at your disposal for any further
information.
Sincerely,
Marie-Laure Denis
This decision may be appealed before the Council of State within two months of its notification.