C029-43 Sephora SAS

Data Transfers
Case project
Controller
Sephora SAS
Case status
Pending (3 - 4 years)
Filed: (3 years 11 months ago)

This is one of noyb 101 complaints which were filed after the "Schrems II" judgement in Summer 2020. The judgement invalidated the EU-US data transfer mechanism "Privacy Shield". The cases were generated based on implemented Google Analytics or Facebook tracking code on websites by EU providers, which leads to unlawful data transfers to the United States.

Protocol
Date Summary
20.06.2022
CNIL explained their decision after noyb asked for some clarifications

As the controller has stopped using Google Analytics, CNIL closed the case.

05.04.2022
CNIL sent us the decision

CNIL sent us the decision.

24.03.2022
CNIL confirmed receipt of that request
16.03.2022
CNIL informed us that they ordered the controller to bring the processing into compliance with the GDPR

CNIL informed us that they ordered the controller to bring the processing into compliance with the GDPR and cease the use of GA. On the same day, noyb asked to be provided with the actual decision by the CNIL.

21.02.2022
noyb asked for an Update

noyb asked for an Update. CNIL replied on the same day, saying that re C029-40 and 43, there will be a decision soon. Re C029-39 and 41 the investigation continues.

20.07.2021
CNIL informed us that the complaint continues to be under investigation

CNIL informed us that the complaints C-029-39 to 43 are still being investigated and we will receive updates.

13.07.2021
noyb asked the CNIL for an update
22.12.2020
noyb wrote an email to the CNIL explaining how the HAR files showed the data transfers that took place
17.12.2020
CNIL asked us to make remarks on the case without providing us with the controllers statement

CNIL asked us to make remarks on the case (without us knowing the controller's submission) and reiterated their position not to share the case files with us.

10.12.2020
CNIL wrote us saying that the controller has confirmed it implements Google Analytics on their website

CNIL wrote us, saying that the controller has confirmed it implements Google Analytics on their website. CNIL asked noyb for any additional comments within one month.

30.10.2020
CNIL replied that they are the the competent authority to begin investigating

CNIL replied that they are the the competent authority to begin investigating. Cannot confirm that there will be no other supervisory authorities involved, however will let us know if there are. Do not want to disclose documents as they are 'administrative'.

29.10.2020
noyb sent follow up email
06.10.2020
noyb resubmitted all six HAR files

noyb resubmitted all 6 HAR files to the CNIL and received the acknowledgement from them that they got the files on the same day.

17.08.2020
Complaint filed