# The President
Chief Executive Officer
Registered letter with acknowledgement of receipt
N°AR :
File Processing :
Ref. no.:
Referral N°
(to be included in all correspondence)
Paris,
12 JUIN 2025
Dear Chief Executive Officer,
I am following up on our exchange of correspondence as part of the investigation of the complaint sent to us by the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), pursuant to the provisions of Article 56.1 of the General Data Protection Regulation (hereinafter "GDPR").
# I. Background to the claim and the facts
The complaint concerned the difficulties encountered by Mrs in exercising her right to have her personal data deleted by the company and the lawfulness of the processing carried out.
The complainant stated that she had not given her consent to the processing of her personal data by and had requested their erasure by e-mail dated 7 July 2020, without receiving a reply.
As part of the investigation into the complaint, the departments of the Commission Nationale de l'Informatique et des Libertés (CNIL) questioned in order to obtain information on the legal basis for the processing and on the reasons why no response had been given to the complainant's erasure request.
was able to specify that the processing of the complainant's data had been carried out at the request of the company. Ms employer, in connection with a proposal to provide services within its teams.
The explanations provided by call for the following comments from the CNIL.
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles
## II. Analysis of the facts
Article 5.1 a) of the GDPR states that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.
In this respect, in order to be lawful and to be able to be implemented, the processing of personal data must be based on one of the legal grounds set out in Article 6 of the GDPR.
In this case, [REDACTED] considers that the processing of her personal data by [REDACTED] is unlawful because she did not give her consent.
On this point, [REDACTED] indicated that the processing was carried out on the basis of the company's legitimate interest (article 6.1 f) of the GDPR), on behalf of [REDACTED], Ms [REDACTED]'s employer.
It stated that the collection and processing of the complainant's personal data took place in the context of commercial discussions between [REDACTED] and [REDACTED] a company established in Germany and represented by Mr [REDACTED], as the latter was considering equipping his structure with a solution developed by [REDACTED].
In this context, the companies agreed at the beginning of July 2020 to simulate the use that Mr [REDACTED] and his team could make of the solution at a demonstration meeting scheduled for 16 July 2020. On this occasion, each member of the [REDACTED] team received an access login, including the complainant.
Against this backdrop, the personal data processing carried out by [REDACTED] which consisted of creating an identifier for [REDACTED] employees to enable them to test a solution, can be considered legitimate in light of the pre-contractual discussions that were underway at the time and necessary in that it enabled [REDACTED]'s employees to test the proposed service. In addition, the processing was carried out within the limits of what was strictly necessary to achieve this legitimate interest and the impact on Ms [REDACTED]'s interests and rights was therefore limited.
As a result, the processing carried out by [REDACTED] did not require it to obtain the consent of the data subjects, who were employees of [REDACTED] and could validly be based on the legal grounds of legitimate interest.
Accordingly, based on the information gathered, the CNIL, with the agreement of the Bavarian data protection authority concerned, rejects Ms [REDACTED]'s complaint regarding the lawfulness of the processing.
- Failure to comply with the obligation to respond to an erasure request (Article 12 of the GDPR)
In law, Article 17 of the GDPR states that the data subject has the right to obtain from the controller the erasure, as soon as possible, of personal data relating to him or her.
2
The controller is then obliged to provide the data subject with information on the measures taken in response to such a request, as soon as possible and in any event within one month of receipt of the request. If necessary, this period may be extended by two months, considering the complexity and number of requests. The data controller shall inform the data subject of this extension and the reasons for the postponement within one month of receiving the request (Article 12.3 of the GDPR).
In addition, if the controller does not comply with the request made by the data subject, it shall inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for its failure to act and of the possibility of lodging a complaint with a supervisory authority and of seeking judicial remedy (article 12.4 of the GDPR).
In this case, after being informed that her personal data were being processed by [REDACTED] when she received her login to access the platform set up by the company for the presentation meeting planned between the two companies, Ms [REDACTED] requested that her personal data be deleted from [REDACTED] by email dated 7 July 2020 sent to the following address: [REDACTED]
When asked by the CNIL about the lack of response to the complainant's request, [REDACTED] confirmed that its teams had received the request on 7 July 2020 and had not responded.
[REDACTED] stated that "after each request, we systematically contact the requesting parties by email or telephone to confirm that the data has been deleted in accordance with our procedures", but that "in the case of Ms [REDACTED] data, insofar as it was added in the context of a commercial discussion with her employer, our procedure for deleting personal data following her request on 07/07/2020 was not applied immediately but after the demonstration period".
As the demonstration meeting took place on 16 July 2020, [REDACTED] proceeded to delete the complainant's personal data on 17 July 2020, i.e. 10 days after her request to exercise her rights, without informing her that the request had been processed.
That being said, I note that [REDACTED] has undertaken to develop its procedure for the erasure of personal data so that, whatever the context of the collection and processing, an explicit response is always given to requests to exercise rights.
However, with the agreement of the supervisory authority concerned, I consider that in this case, by failing to respond to the complainant within the aforementioned time limits, [REDACTED] has breached the provisions of Article 12.3 of the GDPR
These facts justify a reprimand to [REDACTED]
### III. Corrective measures ordered by the CNIL
In view of the above, and in agreement with the Bavarian data protection authority concerned by this processing operation, the following corrective measure should therefore be imposed on [REDACTED]
3
- A REPRIMAND, in accordance with the provisions of articles 58.2.b) of the GDPR and 20.II of the amended Act of 6 January 1978, concerning the obligation to respond to a request to exercise the right to erasure.
Please note that in accordance with Article 77 of the GDPR, the person who lodged the complaint will be informed of this decision.
This decision, which closes the investigation into complaint no. [REDACTED], does not preclude the CNIL from making use, particularly in the event of new complaints, of all the other powers conferred on it by the GDPR and by the amended Act of 6 January 1978.
In any event, I would add that it is [REDACTED]'s responsibility to ensure that it complies with all the aforementioned provisions relating to all the processing operations that the company implements.
The CNIL ([REDACTED] Complaints department. [REDACTED]) will be happy to provide any further information you may require.
This decision may be appealed to the Conseil d'état within two months of notification.
Yours faithfully
Marie-Laure Denis
4