| CNIL - Referral Number: 20019819 | |
|---|---|
 | |
| Authority: | CNIL (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 12 GDPR Article 13 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 06.12.2021 |
| Published: | 06.12.2021 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Referral Number: 20019819 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | EDPB (in EN) |
| Initial Contributor: | Alexander Smith |
CNIL reminds controller that all processing types must be covered within the relevant privacy policy or this may constitute a breach of Article 12 GDPR and Article 13 GDPR.
English Summary
Facts
The controller asked data subject to provide an email address so that contact could be made in the event of a product recall. The data subject asked for confirmation and guarantee about how their personal data would be used. The controller referred the data subject to the privacy policy on their website. The existence of processing personal data relating to a product recall was omitted from the privacy policy.
Holding
As the Privacy Policy on the website did not mention the existing of processing of personal data relating to product recall, this constitutes a breach of Article 12 GDPR and Article 13 GDPR.
Comment
This concerned a complaint raised in Hungary. The Hungarian Data Protection Authority referred the matter to CNIL per Article 56(1) GDPR. The decision of CNIL was later shared with the EDPB per Article 60(7) GDPR.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
,
