DPA case Unknown – Order (France, 2022)

A data subject wished to exercise his right to erasure under Article 17 regarding two customer accounts linked to him with a company (controller). He claimed that he was forced to provide an identity document to make his request and that he did not receive confirmation that his requests had been taken into account. This led him to lodge a complaint with his local DPA (in Germany). In accordance with Article 56(1) and Article 60, the German DPA transferred this complaint to the French DPA, the CNIL. During the proceedings, the controller explained that this type of identity verification - through the user's ID document - was systematically required when the data subject exercised their rights via the website form. In this particular case, instead of being redirected to his personal account, from within which he could have exercised his erasure request, the data subject had been wrongfully routed into another ID verification process. The controller's DPO reported that he had already risen staff's awareness in this respect. The controller also now placed a notice under the online form inviting customers to log in to their personal account so that they do not have to prove their identity. Taking into account the explanations provided by the DPO and the measures that were already in place, the CNIL decided that the chances of a repetition such facts were avoided and therefore closed the complaint.