C029-42 Auchan E-commerce France
Case projectData Transfers
ControllerAuchan E-commerce France
Case statusOther Outcome
This is one of noyb 101 complaints which were filed after the "Schrems II" judgement in Summer 2020. The judgement invalidated the EU-US data transfer mechanism "Privacy Shield". The cases were generated based on implemented Google Analytics or Facebook tracking code on websites by EU providers, which leads to unlawful data transfers to the United States.
CNIL informed us that the controller has stopped using Google Analytics and they will close the case
CNIL informed us that the controller has removed Google Analytics from www.auchan.fr and that CNIl hence ended the investigation against the controller. On the same day, noyb asked, if that email from the CNIL is the actual decision.
CNIL informed us that they have ordered the controller to bring the processing in connection with Google Analytics into compliance with Article 44 GDPR within one month
CNIL informed us that they have ordered the controller to bring the processing in connection with Google Analytics into compliance with Article 44 GDPR within one month, if necessary by stopping to use Google Analytics.
CNIL informed us that the complaint continues to be under investigation
CNIL informed us that the complaints C-029-39 to 43 are still being investigated and we will receive updates.
noyb asked the CNIL for an update
noyb wrote an email to the CNIL explaining how the HAR files showed the data transfers that took place
CNIL asked us to make remarks on the case without providing us with the controllers statement
CNIL (referring to a phone call with us) again asked us to make remarks on the case (without us knowing the controller's submission) and reiterated their position not to share the case files with us.
CNIL wrote us saying that the controller has confirmed it implements Google Analytics on their website
CNIL wrote us, saying that the controller has confirmed it implements Google Analytics on their website. CNIL asked noyb for any additional comments within one month.
CNIL replied that they are the the competent authority to begin investigating
CNIL replied that they are the competent authority to begin investigating. Cannot confirm that there will be no other supervisory authorities involved, however will let us know if there are. Do not want to disclose documents as they are 'administrative do
noyb sent follow up email
noyv sent follow-up email, also requesting access to documents.
noyb resubmitted all six HAR files