CNIL (France) - SAN-2025-015

links to the Articles === Facts ====== Facts === A software consulting company (the processor) provided an administration (the controller) with software for processing files relating to persons with disabilities. This software enabled users (data subjects) to upload their files and track their progress via an online portal. Nextpublica, a software consulting company (the processor) provided the Maison Départementale pour les Personnes Handicapées MDPH, a public interest group (the controller), with software for processing files relating to persons with disabilities. This software enabled users (data subjects) to upload their files and track their progress via an online portal. On 2 November and 10 November 2022, data subjects using the portal reported to the controller that they had access to files relating to other data subjects. On 2 November and 10 November 2022, data subjects using the portal reported to the controller that they had access to files relating to other data subjects.