¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
File processing:
Paris, le 16 DEC. 2024
N/Ref : SGE/LCN/CLA242901
Referral N°
(to be included in all correspondence)
Dear Sir
We write further coming to your complaint no. in order to inform you of the action taken on your case by the Danish Data Protection Authority.
You had lodged a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) against regarding the security of personal data.
As you know, in application of the mechanisms for cooperation between authorities provided for in the General Data Protection Regulation (GDPR), the CNIL has forwarded your complaint to the Danish data protection authority, which is competent to to investigate it because s head office is in Danemark.
Pursuant to Article 77 of the General Data Protection Regulation (GDPR), I hereby inform you of the decision adopted in this case, following this cooperation procedure.
In particular, you state that, following your registration on the website, your login and password had been sent to you by unencrypted e-mail.
As part of the investigation of your complaint, the Danish authority questioned which replied as follows.
The company stated that in 2022, when an online account was created on the platform in order to subscribe to the refund offer (ODR), users received an electronic confirmation of their registration. This message contained an identifier and a temporary password in clear text. The users then had the option of changing their password from their online account.
Since 2023, has changed its practice. When creating an online account on the platform, users are asked to choose a password. They then receive an electronic confirmation of their registration containing their identifier and the words "password: only you know it".
If you wish to reset your password, you can do so from your online account. They will then receive an e-mail without a username but with a link to the website, where they can change their password using the unique hyperlink contained in the e-mail, valid for one hour.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL
As part of the investigation, the Danish Data Protection Authority asked you on 24 June 2024, whether you wished to make any comments regarding the response provided by
In the absence of a response from you, the Danish protection authority did not pursue the investigation of the complaint. It also stated that continuing the investigation would not have enabled to put in place better compliance measures. Indeed, since your complaint was lodged, has modified its account creation and authentication procedure.
In view of these elements, and in particular the measures implemented by , I hereby inform you that, in accordance with the European data protection authorities, your complaint will be closed.
Yours sincerely,
Head of rights and complaints department
Protection of Rights ans Sanctions Department