CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The Chairman
Registered letter with acknowledgement of receipt
N°AR: LC 151 962 69377
Paris,
16 DEC. 2024
File processing:
Ref: MLD/SBA/ROL231046
Complaints Ref.
(to be included in all correspondence)
Dear Madam,
I am following up on exchanges between the services of the Commission Nationale de l'Informatique et des Libertés (CNIL) and the Data Protection Officer (hereinafter "DPO") of the company [REDACTED], now [REDACTED] (hereinafter "the company [REDACTED]"), involved in the investigation of several complaints sent to the CNIL by the Baden-Württemberg Data Protection Authority (Länder Commissioner For Data Protection And Freedom Of Information; referrals nos. [REDACTED]) pursuant to Article 56.1 of the General Data Protection Regulation (GDPR), as well as the investigation of a complaint received directly from a customer of your platform (referral no. [REDACTED]).
# I. Summary of claims and facts
The complaints concern the lack of information prior to receiving the [REDACTED] newsletter (complaints n [REDACTED] and n' [REDACTED]) as well as the difficulties encountered in unsubscribing via the link provided for this purpose (complaints n [REDACTED], n' [REDACTED], n' [REDACTED], n' [REDACTED] and n [REDACTED]) or following requests sent to the [REDACTED] messaging service (complaint n [REDACTED]) or to customer service (complaints n [REDACTED] and n' [REDACTED]).
The response provided by [REDACTED]'s DPO has led me, with apologies for the delay, to raise the following points.
# II. Analysis of the facts
1. Failure to comply with the obligation to provide transparent information and communications and the procedures for exercising the data subject's rights
Pursuant to Article 12 of the GDPR, the controller must take appropriate measures to provide any information referred to in Articles 13 and 14 of the GDPR and to make any communication to the data subject, in particular under Articles 17 and 21 of the GDPR, in a concise, transparent, comprehensible and easily accessible manner and in clear and simple terms (Article 12.1 of the GDPR).
In particular, pursuant to Articles 13.1 c) and 13.2 b) of the GDPR, the controller must inform the data subjects from whom the personal data is collected of the purposes of the processing and of their right to object.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
In this case, [REDACTED]'s DPO told the CNIL in May 2019 that the lack of information provided to data subjects about the collection of their email address for canvassing purposes and their opportunity to object only concerned the [REDACTED] site in its "France" version, and not all the other European versions of the site.
I thus note that users of the French version of the [REDACTED] website, when entering their contact details on the company's website to purchase a ticket, in particular their e-mail address, were informed neither that this address would be used for canvassing purposes nor of the procedures available for objecting to such use. As a result, they did not have the opportunity to consent to or object to receiving commercial canvassing at the time of collection.
In addition, the controller must respond to persons who have made a request to exercise a right, indicating the measures taken "as soon as possible and in any event within one month of receipt of the request" (Article 12.3 of the GDPR).
The controller who does not comply with the request made by the data subject must inform him or her "without delay and at the latest within one month of receipt of the request of the reasons for his or her failure to act and of the possibility of lodging a complaint with a supervisory authority and of seeking judicial remedy" (Article 12.4 of the GDPR).
In the present case, in the context of complaints [REDACTED] and [REDACTED], the applicants requested their unsubscription from the newsletter from the DPO and customer service several times before obtaining a response. For example, a complainant (complaint [REDACTED]) stated that he had contacted the DPO five times and customer service once between 28 September and 1er November 2018, while another (complaint [REDACTED]) stated that he had contacted customer service twice between 19 July and 16 August 2018. In the case of the latter complainant, the DPO indicated that it was only after his request was repeated in 2020 that a reply was sent to him.
Consequently, I consider that [REDACTED] has breached the provisions of Article 12(1), (3) and (4) of the GDPR by not properly informing users of its website and by not providing a response to requesters within the time limit of one month from receipt of the request.
# 2. Failure to offer the possibility of objecting to direct marketing of similar products or services
In law, article L. 34-5 of the CPCE (French Post and Electronic Communications Code) states that "Direct marketing by means of an automated electronic communications system within the meaning of 6° of article L. 32, a fax machine or electronic mail using the contact details of a natural person, subscriber or user, who has not given prior consent to receive direct marketing by this means, is prohibited.
[...] However, direct prospecting by electronic mail is authorised if the recipient's contact details have been collected from him/her, in compliance with the provisions of law no. 78-17 of 6 January 1978 relating to information technology, files and civil liberties, in connection with a sale or the provision of services, if the direct prospecting concerns similar products or services provided by the same natural or legal person, and if the recipient is offered, in an express and unambiguous manner, the possibility of objecting, free of charge, apart from those linked to the transmission of the refusal, and in a simple manner, to the use of their details at the time they are collected and each time an electronic canvassing email is sent to them in the event that they have not refused such use from the outset. [...]".
In this case, several applicants stated that when they purchased a ticket, they had neither agreed to receive commercial canvassing nor been given the opportunity to object to receiving emails promoting goods and services similar to those purchased (complaints [REDACTED] and [REDACTED]).
Discussions between CNIL and [REDACTED] revealed that, at the time of the events, no means of objecting to receiving commercial canvassing was provided when the contact details were collected. The [REDACTED] company stated that an unsubscribe box has since been integrated into all web and mobile versions of the company's website.
2
The applicants also pointed out that the unsubscribe link in the newsletter was ineffective (complaints ).
The company also confirmed to the CNIL that the unsubscribe link was dysfunctional due to a technical problem preventing "marketing teams from finding the customer who clicked on the unsubscribe link to unsubscribe".
Consequently, I consider that has breached the provisions of Article 34.5 of the CPCE by not allowing the data subjects to object to the use of their contact details at the time of their purchase and the collection of their data, as well as each time a canvassing e-mail is sent to them.
# 3. Failure to respect the right to object
Pursuant to Article 12.2 of the GDPR, "the controller shall facilitate the exercise of the rights conferred on the data subject under Articles 15 to 22".
Pursuant to Article 21.2 and 3 of the GDPR, "where personal data are processed for the purposes of canvassing, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such canvassing purposes" and "where the data subject objects to processing for canvassing purposes, the personal data shall no longer be processed for those purposes".
In light of these provisions, consideration 70 of the GDPR specifies that, with regard to the right to object to the processing of one's data for canvassing purposes, "the data subject should have the right to object to such processing at any time and free of charge".
In this case, as they were unable to object to receiving the newsletter at the time of collection or by using the unsubscribe links included in the emails sent, several complainants (complaints ) contacted the company to exercise their right to object. Some of them had to repeat this request several times before it was taken into account (complaints and ).
Thus, as part of complaint , the complainant told the CNIL that he had asked the company to remove his personal data from the database so that he would no longer receive emails by contacting the DPO on 28 September, 5, 11, 18 and 25 October 2018 and the customer service department on 1er November 2018. The complainant referred the matter to the CNIL after receiving a new request on 17 January 2019.
With regard to complaint , the complainant contacted customer services on two occasions, on 19 July and 16 August 2018, to request his unsubscription.
In the context of complaint , the complainant continued to receive the newsletter despite using the unsubscribe link and receiving a message confirming that his unsubscription had been taken into account and despite contacting customer service and receiving a message confirming his unsubscription. Although customer service told the complainant in its reply of 1er September 2018 that it could take up to seven days before he stopped receiving newsletters, the complainant stated that he had received new ones after he had received them, on 12, 13, 17, 18, 26 and 28 September 2018.
In exchanges with the CNIL, did not dispute these points and indicated that it had since taken measures to take account of the requests for objection made by the complainants and thus satisfy the requests.
With regard to complaint , the DPO replied to the CNIL in April 2019 that, according to information obtained from the customer relations department, the last exchanges with the complainant were dated 1er November 2018 and that, as of the date of the reply to the CNIL, this customer had unsubscribed from their newsletters and would not be re-subscribed in the event of a new purchase on the website.
The DPO stated in 2021 that, with regard to referral no. , no trace of the applicant's request had been found because the 2018 data is "stored in a customer relationship management tool that has been cancelled". It was specified that this person did not appear in any of their databases with
3
the email address indicated, and therefore did not receive any email from [REDACTED]. With regard to complaint [REDACTED], the CNIL was told that the situation was the same as for the previous case in terms of request history, but that this person had repeated his request in 2020, and was therefore de-registered on 14 June 2020.
Consequently, I consider that, at the time of the events, the [REDACTED] company failed to comply with the provisions of Articles 12, and 21.2 and 3 of the GDPR in that the complainants were unable to easily exercise their right to object by having to repeat their requests and received new solicitations after having made known their objection to being solicited.
### III. Corrective measures ordered by the CNIL (art. 58-2 of the GDPR)
In view of the infringements thus identified, and in agreement with the other data protection authorities concerned by this processing operation which have been consulted, the following corrective measures should therefore be taken against [REDACTED], now [REDACTED]
A REPRIMAND, in accordance with the provisions of Article 58.2 b) of the General Data Protection Regulation (GDPR) and Article 20.II of the amended Act of 6 January 1978 concerning :
- the obligation to provide transparent information and communications and the procedures for exercising the rights of the data subject;
- the obligation to offer the possibility of objecting to direct marketing of similar products or services;
- the obligation to respect the right to object.
This decision takes into account the measures implemented by the company, regarding the evolution of the information on the [REDACTED] website in its "France" version, the integration of an unsubscribe box in all the web and mobile versions of [REDACTED], the correction of the malfunctioning of the unsubscribe link in January 2019 and the taking into account of the opposition requests made by the complainants. The DPO's services confirmed in October 2024 that, after further checks, they had had no further contact with the complainants and that the latter were not receiving any commercial solicitations from them.
I would point out that, in accordance with Article 77 of the GDPR, the persons behind the complaints referred to herein are informed of this decision.
This closes the investigation of complaints [REDACTED] and [REDACTED]. However, it does not rule out the CNIL making use, particularly in the event of new complaints, of all the other powers conferred on it by the GDPR and by the amended Act of 6 January 1978.
The Commission's departments ([REDACTED] - legal officer, Rights and Complaints Department) will be happy to provide you with any further information you may require.
This decision may be appealed to the Conseil d'État within two months of notification.
Yours sincerely
4