The Chairwoman
For the attention of
management
Par LRAR n
Paris, g • —2
Case investigator:
Ref. no.:
Case No.
(to be quoted in all correspondence)
Dear Sir or Madam,
I am following up on the various exchanges that took place between the French Data Protection
Authority (CNIL) and the Data Protection Officer (DPO) of in connection with
the investigation of the complaint lodged by , which was forwarded to us by the data
protection authority of North Rhine-Westphalia — Westphalia pursuant to Article 56 of the General Data
Protection Regulation (GDPR).
As a reminder, the complainant alleges a breach of personal data by .
In particular, he states that he contacted on 25 March 2023 to obtain the
photographs taken with a self-service photo booth during the held in
Germany. However, in its reply dated 4 April 2023, the company sent him fifteen zip files
containing all the photographs taken with this photo booth since December 2022.
When questioned on this matter by the CNIL, stated that this
unauthorised disclosure of personal data was the result of an isolated human error. In fact, since the
complainant did not enter the correct email address in the system, he had to contact
to obtain his photographs. However, it appears that the employee who
received and processed this request entered the complainant's email address in the wrong field in the photo
booth's data management software, which resulted in all the photographs taken with the photo booth being sent
to him. In total, photographs of approximately 1,000 visitors were thus disclosed to the complainant.
states that it was alerted by the complainant on the same day as the
The personal data necessary for the CNIL to carry out its tasks is processed in files intended for its exclusive use.
Data subjects may exercise their data protection rights by contacting the CNIL's Data Protection Officer (DPO).
„i/ „g /ryr „//;ro om /iwwo æ„ ner <m„rrior norm/ 0æ„< on <n,.<i m/.xr • ..n.o.z <mî/ £</Næwnoo<. nor<cnc f/r
receipt of the photographs in question. Upon receipt of this alert, immediately
deactivated the device in question in order to conduct the necessary investigations and take appropriate
measures to prevent any further disclosure.
In this regard, the company states that it first responded to the complainant to apologise, inform them
of the reasons for this data breach and ask them to delete all the photographs in question. The company has
produced a copy of the complainant's response dated 13 March 2025 confirming the deletion of this data.
Secondly, following this incident, the company states that it has adopted measures to strengthen the
security of personal data processing carried out in connection with the use of this device. Thus, the retention
period for personal data collected in this context, namely photographs and associated email addresses, has
been reduced to 30 days, after which they are automatically deleted. The company also states that it is using a
new service provider for this type of service in order to strengthen its compliance with personal data protection
regulations.
Thirdly, has recorded this incident in its data breach register, a copy of
which has been provided to the CNIL.
Finally, it should be noted that the data affected by this breach consists solely of photographs taken
with a photo booth during a public exhibition. Furthermore, according to information provided by the data
controller during the investigation, this data was only disclosed to the complainant, who confirmed that it
had been deleted and never shared with third parties. Consequently, it is considered that this data breach was
not likely to result in a high risk to the data subjects and was therefore not subject to the notification
requirement provided for in Article 33 of the GDPR.
In this context, the responses provided by and the measures
spontaneously implemented to prevent any further data breaches have led me, in agreement with the other
European data protection authorities concerned by this processing, to close this complaint.
However, the CNIL reserves the right, in the event of further complaints, to exercise all the powers
conferred on it by the provisions of the GDPR and Law No. 78-17 of 6 January 1978, as amended, relating
to information, files and freedoms.
Yours sincerely, On behalf of the President of the CNIL, and by
delegation,
Copy.
Data Protection Officer
2