CE - 466856

From GDPRhub
Revision as of 11:17, 4 October 2023 by Mg (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
CE - 466856
Courts logo1.png
Court: CE (France)
Jurisdiction: France
Relevant Law: Article 16 GDPR
Decided: 26.06.2023
National Case Number/Name: 466856
European Case Law Identifier: ECLI:FR:CECHS:2023:466856.20230626
Appeal from: CNIL (France)
Appeal to: Unknown
Original Language(s): French
Original Source: Légifrance (in French)
Initial Contributor: n/a

The French Supreme Administrative Court held that the right to rectification can be used to rectify data after an identity change but not retroactively to rectify documents prior to the identity change.

English Summary[edit | edit source]

Facts[edit | edit source]

A data subject was registered in the information system of the company Verifone, a payment service provider (controller). After changing her identity, she requested a court in the USA to order the rectification of her customer account data (surname, first name, email) and of her data appearing in other documents such as orders. The court refused, and the data subject referred the matter to the French DPA (CNIL).

The CNIL contacted the controller to ask it to rectify the data subject's customer account data, which it did for the customer account data but not for the other documents. The CNIL considered that the documents drawn up before the change of identity did not need to be rectified retroactively because the change of identity happened later.

The data subject took the CNIL's decision to the Conseil d'Etat (Supreme Administrative Court).

Holding[edit | edit source]

For the documents drawn up before the identity change, the Conseil d'Etat considered that the data could not be considered as inaccurate since they were accurate at the time and for the purpose of the processing. These documents therefore did not contain any inaccuracies that should have been corrected under Article 16 GDPR.

Consequently, the Conseil d'Etat upheld the CNIL's decision, considering that the CNIL correctly applied Article 16 GDPR.

Comment[edit | edit source]

Share your comments here!

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the French original. Please refer to the French original for more details.