CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
Registered letter with acknowledgement of receipt
DIRECTION
File processing:
Ref. no.:
Complaint no.
(to be included in all correspondence)
Paris, on June 12th, 2025
Madam, Sir,
I am following up on the email exchanges that took place between the services of the French data protection authority (Commission nationale de l'informatique et des libertés or « CNIL ») and [REDACTED] Data Protection Officer, as part of the investigation of Mr [REDACTED]'s complaint forwarded by the Luxembourg data protection authority (Commission nationale pour la protection des données Grand-Duché de Luxembourg), in application of the mechanism for cooperation between European authorities in accordance with Articles 56 et seq. of the General Data Protection Regulation (GDPR).
In support of his complaint, the complainant stated that, by e-mail dated 15 March 2022, he had asked [REDACTED] to object to the processing of his personal data for marketing purposes. In response, [REDACTED] informed the complainant that it did not hold any of his personal data and invited him to contact its service provider, [REDACTED], which was responsible for sending the commercial prospecting mailings.
Despite exercising his right to object, the complainant claims that he continues to receive prospecting emails.
As part of the investigation of this complaint, the CNIL contacted [REDACTED]
In response, the company first confirmed that it uses a processor, [REDACTED], to carry out postal marketing on its behalf. In this context, it specified that it did not have access to the data used by its processor to carry out these prospecting operations and that it could not intervene directly in the prospecting file to ensure that objection requests were actually taken into account.
However, it states that it has set up an objection file called the "Pusher File", which is used to record objection requests from prospective customers in order to send [REDACTED] the information necessary to ensure that their rights are respected.
In the complainant's case, it added that his request could not be granted because he was on [REDACTED]'s mailing list under the name [REDACTED], whereas he had sent his objection request under the sole name of [REDACTED].
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif.
Les personnes concernées peuvent exercer leurs droits Informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles
I remind you that, in accordance with the provisions of Article 21(3) of the GDPR, " where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes ".
In this case, [REDACTED] was unable to comply with the complainant's objection request.
It is therefore the responsibility of [REDACTED] to implement measures to ensure that people's objections are taken into account effectively and over time.
However, I note that [REDACTED] has taken measures to remedy the situation. The company informed the complainant on 6 February 2024 that his request had been re-examined and that he had been reinstated in the objection file with both surnames. [REDACTED] also stated that it had asked its service provider to take into account requests with similar spellings for a person identified at the same address. This measure has been in place since the third quarter of 2024.
With regard more specifically to postal addresses, the free form of an address field allows many different formulations which could lead to different imprints (e.g. "avenue" being written "av.", "Av" or even misspelled "Avenu"). As the imprints calculated on different formats of the same address are distinct, it is difficult to compile a reliable pusher list.
To get around this problem, techniques can be used to harmonize the formatting of address files or to use geocoding techniques. With these tools, it is possible to offer people entering their address on your site an interactive address entry interface to validate an exact address in a standardized format (e.g. by autocompletion using the first few characters of the address). It will then be possible to use the imprints of these confirmed addresses to build up a reliable pusher list.
Since I have no doubt that [REDACTED] will take appropriate measures to ensure that the objection requests it receives are effectively taken into account, I hereby inform you, in agreement with the other European data protection authorities concerned, that I am closing this complaint.
I would nevertheless like to point out that the CNIL reserves the right, in the event of further complaints, to make use of all the powers conferred on it by the GDPR and the amended Act of 6 January 1978.
Yours sincerely,
For the President of the CNIL and by delegation,
2
Subject to the applicant's right to bring an action, CNIL decisions may be appealed to the Conseil d'Etat within two months of notification, plus :
- one month for residents of Guadeloupe, French Guiana, Martinique, Réunion, Saint-Barthélemy, Saint-Martin, Mayotte, Saint-Pierre-et-Miquelon, French Polynesia, the Wallis and Futuna Islands, New Caledonia and the French Southern and Antarctic Territories;
- two months for people living abroad.
3