Summary Final Decision Art 60
Complaint
Reprimand to the controller
Background information
Date of final decision: 25 February 2020
LSA: FR
CSAs: BE, DE Berlin, DE Hesse, DE Lower Saxony, DE Mecklenburg-Western Pomerania, DK, ES, FI, SE, UK
Legal Reference: Responsibility of the controller (Article 24), Security of processing (Article 32)
Decision: Reprimand
Key words: Password, Right of access, Marketing preferences, Data security
Summary of the Decision
Origin of the case
The complainants have encountered difficulties during exercise of the right to object to direct marketing and rights of access and portability.
Findings
The LSA found out during the investigation that an incident arose during the migration of the controller’s consent management tool for marketing communications, causing consents not given/withdrawn considered as given/not withdrawn, and the users’ communication preferences not to be taken into account in the controller’s communication campaigns.
Although the LSA noted that the problem had been solved and that the users’ communication preferences had been restored, it stems from this incident that, prior the migration of its consent management tool, the controller had not implemented the necessary measures as required by the Article 24 GDPR
The LSA also found that the controller’s procedure to process access requests was not fully compliant with the Article 32 GDPR. Indeed, the LSA noted that, in absence of a client account, the username and password for connection to content containing data personal data were sent to data subjects via one and the same channel.
Thus, the controller has been asked to modify this procedure. The LSA determined that the controller had improved the procedures to handle data subject rights requests and trained employees on such procedures.
Decision
The LSA issued a reprimand to the controller.
—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_fr_2020_rights_of_the_data_subject_summarypublic.pdf
Please see also EDPB Copyright page