CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
The Chairman
By registered letter no.
File processing :
Ref. number:
Referral No.
(to be included in all correspondence)
Paris,
Dear Madam,
I am following up on the various exchanges that have taken place between the services of the Commission Nationale de l'Informatique et des Libertés ("CNIL") and those of , as part of the investigation of complaint no. submitted by the Irish Data Protection Authority (the Data Protection Commission or, hereinafter, "DPC") pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (hereinafter "the GDPR").
# I. Background to the claim and the facts
Mr lodged a complaint with the DPC concerning the difficulties encountered in exercising his right of access to his personal data held by . He stated that he had requested a copy of his data held by "in all its offices" by e-mail dated 15 April 2023 via the e-mail address , using the " form sent to the address . No response was received to this request.
As part of the preliminary checks prior to forwarding this complaint to the CNIL, the DPC, in two emails dated 4 August and 28 August 2023, forwarded Mr 's access request form to the address and asked what action it intended to take. No reply was received other than an automatic acknowledgement of receipt dated 4 August 2023.
The CNIL then contacted to ask about the facts brought to their attention.
Discussions with have led me to make the following observations.
# II. Analysis of the facts
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenay, TSA 60715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont conservées et traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
- Failure to respond to a request to exercise personal rights
**Pursuant to the provisions of Article 12.3 of the GDPR,** " *The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.* »
**Under the terms of Article 12.4 of the GDPR,** "*If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy*".
**In this case**, it was only on 2 January 2024, after 2 requests from the DPC and a second intervention by the CNIL, that [REDACTED] responded to Mr [REDACTED]'s request for access made on 15 April 2023. The company then informed the CNIL that it had not been able to find this request in its IT systems.
In addition, although the complainant indicated on 3 January 2024 that the response he received was incomplete, it was only on 20 December 2024, after further intervention by the CNIL, that [REDACTED] responded by sending him an updated copy of his data.
It is therefore clear from all these elements that [REDACTED] provided an initial response to Mr [REDACTED]'s request for access 8 months after receiving it and a complete response 20 months after his initial request and following several interventions by the data protection authorities, two by the DPC and 7 by the CNIL.
**Consequently**, I consider that [REDACTED] has failed to comply with the provisions of Article 12 of the GDPR, by not responding to the data subject within the time limit of one month from receipt of his request, both for his initial request and for his additional request.
- Failure to respond to a request for right of access
**Pursuant to the provisions of Article 15.1 GDPR,** " *The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data* ". In addition, pursuant to the provisions of Article 15.3 of the GDPR, "*The controller shall provide a copy of the personal data undergoing processing*".
By way of illustration, point 35 of the EDPB Guidelines on the right of access states that "*Data subjects shall have the right to obtain [...] full disclosure of all data relating to them*".
**In this case**, Mr [REDACTED]'s request for access, made on 15 April 2023, remained unanswered until 2 January 2024, after the CNIL intervened.
2
In addition, when Mr [REDACTED] questioned the completeness of the reply on 3 January 2024, [REDACTED] replied that, after checking, it appeared to include all the data concerning him held by [REDACTED] on the date of the reply, apart from two items already in its possession, namely the [REDACTED] form mentioned above and the copy of an attachment sent by the complainant in support of a complaint.
However, after a new referral to the DPC and a new intervention by the CNIL, [REDACTED] finally indicated that new investigations had made it possible to send Mr [REDACTED] an updated copy of his data by a new e-mail dated 20 December 2024, containing, in addition to the data previously transmitted, a conversation with the customer service department via chat dating back to April 2024 as well as a telephone call report note indicating "PAX CALLED TO CHECK STATUS OF THE CLAIM" in a comment dated 19 April 2023 on the related claim. [REDACTED] stated that its limited interest probably explained why it had not been returned in the first copy sent.
However, in view of the one-year retention period for this data, [REDACTED] indicated that it was not possible for it to specify whether, on the date of the first request for access made by Mr [REDACTED] on 15 April 2023 and then, on the date of [REDACTED] first response in January 2024, chat conversations dating from 2023 should have been sent to it.
Consequently, it is clear from these elements that [REDACTED] did not provide a satisfactory response until 20 months after Mr [REDACTED]'s initial request and that the time that has elapsed does not make it possible to ensure its completeness, as the response could have contained more information if the one-month time limit had been respected, given the storage period of certain data.
Consequently, I believe that [REDACTED] has breached the provisions of Article 15 of the GDPR by failing to provide a complete response to the data subject.
- Failure to cooperate with the supervisory authority
Pursuant to the provisions of Article 31 of the GDPR, the controller and processor and, where appropriate, their representatives shall cooperate with the supervisory authority, at the latter's request, in the performance of its tasks.
Article 18 of Law no. 78-17 of 6 January 1978 on data processing, data files and individual liberties states that "Members of the Government, public authorities, managers of public or private companies, heads of various groups and, more generally, holders or users of personal data processing or files may not oppose the action of the Commission nationale de l'informatique et des libertés or its members and must, on the contrary, take all useful measures to facilitate its task".
In this case, [REDACTED] did not provide any response, other than an automatic acknowledgement of receipt, to the two emails sent by the DPC to the Data Protection Officer's email address. In this respect, [REDACTED] stated that, insofar as the CNIL is the lead data protection authority for [REDACTED], its understanding was that the CNIL was its sole point of contact and interlocutor for this type of request, details that it could easily have provided to the DPC in response to its requests.
3
In addition, although [REDACTED] acknowledged receipt of the first letter of instruction sent to it, it was only after sending a reminder by registered letter with acknowledgement of receipt that replied to the CNIL.
Lastly, its response subsequently turned out to be partial, since after confirming that it had sent the complainant all the information in its possession on 26 July 2024, pointing to data that had in fact already been sent to the complainant earlier, [REDACTED] finally informed the CNIL on 20 December 2024 that it had sent a supplementary response to him.
It took more than five interventions by CNIL, including a second reminder by registered letter, to finalise the investigation of this complaint, which was made delicate by the circumstances, and to ensure that the complainant obtained a resolution to the problem he had raised.
It therefore appears that the action taken in response to requests from the supervisory authorities did not comply with the aforementioned provisions of the GDPR.
I **therefore** consider that [REDACTED] has breached the provisions of Article 31 of the GDPR.
These facts justify a reprimand against [REDACTED].
### **III. Corrective measure ordered by the CNIL (art. 58-2 of the GDPR)**
In view of these elements, and in agreement with the other data protection authorities concerned by this processing operation, the following corrective action should be taken against [REDACTED]:
- **A REPRIMAND**, in accordance with the provisions of Article 58.2.b) of the General Data Protection Regulation (GDPR) and Article 20.II of amended Law No. 78-17 of 6 January 1978 on data processing, data files and individual liberties, concerning breaches of the obligations to respond to requests to exercise rights, to provide access to the applicant's data and to cooperate with the supervisory authorities.
This decision takes into account the fact that, since the CNIL intervened, [REDACTED] has responded to the complainant's request.
I would like to inform you that, in accordance with the provisions of Article 77 of the GDPR, Mr [REDACTED], the author of the complaint that gave rise to this case, has been informed of this decision.
This decision, which concludes the investigation of the complaint, does not preclude the CNIL from making use, particularly in the event of new complaints, of all the other powers conferred on it by the GDPR and by the aforementioned amended Act of 6 January 1978.
The CNIL ([REDACTED]) Complaints Department - Public, Social and Financial Affairs, [REDACTED] is available for further information you may require.
This decision may be appealed to the Conseil d'État within two months of notification.
4
Yours sincerely
Marie-Laure DENIS
Copy by e-mail to [REDACTED] Data Protection Officer
5