CNIL (France) - SAN-2025-015

On 2 November and 10 November 2022, data subjects using the portal reported to the controller that they had access to files relating to other data subjects. On 2 November and 10 November 2022, data subjects using the portal reported to the controller that they had access to files relating to other data subjects. On 22 November 2022, the controller notified the data breach to the DPA. On 22 November 2022, the controller notified the data breach to the DPA. The breach was found to be due to a configuration mistake, made by the processor. The breach was found to be due to a configuration mistake, made by the processor.After an on-site inspection, the DPA opened an investigation. After an on-site inspection, an investigation has been opened by the DPA. On 29 October 2025, the rapporteur closed the investigation. The DPA’s decision is dated 22 December 2025. === Holding ====== Holding ===