CNIL (France) - 20019819

From GDPRhub
Revision as of 17:04, 6 December 2023 by Ar (talk | contribs) (Ar moved page CNIL (France) - Referral Number: 20019819 to CNIL (France) - 20019819)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
CNIL - Referral Number: 20019819
Authority: CNIL (France)
Jurisdiction: France
Relevant Law: Article 12 GDPR
Article 13 GDPR
Type: Investigation
Outcome: Violation Found
Decided: 06.12.2021
Published: 06.12.2021
Fine: n/a
Parties: n/a
National Case Number/Name: Referral Number: 20019819
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): English
Original Source: EDPB (in EN)
Initial Contributor: Alexander Smith

CNIL reminds controller that all processing types must be covered within the relevant privacy policy or this may constitute a breach of Article 12 GDPR and Article 13 GDPR.

English Summary


The controller asked data subject to provide an email address so that contact could be made in the event of a product recall. The data subject asked for confirmation and guarantee about how their personal data would be used. The controller referred the data subject to the privacy policy on their website. The existence of processing personal data relating to a product recall was omitted from the privacy policy.


As the Privacy Policy on the website did not mention the existing of processing of personal data relating to product recall, this constitutes a breach of Article 12 GDPR and Article 13 GDPR.


This concerned a complaint raised in Hungary. The Hungarian Data Protection Authority referred the matter to CNIL per Article 56(1) GDPR. The decision of CNIL was later shared with the EDPB per Article 60(7) GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.