Enforcement · CNIL ·SAN-2025-015 EN LLM context

CNIL fines data processor €1.7M for misconfigured disability-records software causing

The data protection authority (DPA) has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program.

Original title: CNIL (France) - SAN-2025-015

€1,700,000 Fine

France

Controllers Processors Processing Data Breaches Human Resources

Jan 12, 2026

Summary

This program processed files related to people with disabilities, which resulted in a large-scale data breach. The DPA has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program. This program processed files related to people with disabilities, which resulted in a large-scale data breach. Summary in English. Summary in English. Facts. A software company...

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The data protection authority (DPA) has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program. This program processed files related to people with disabilities, which resulted in a large-scale data breach. The data protection authority has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program. This program processed files related to people with disabilities, which resulted in a large-scale data breach. Summary in English. Summary in English. Facts. A software consultancy firm (the data processor) provided software to a government agency (the data controller) for the processing of files related to people with disabilities. A software consultancy firm (the data processor) provided software to a government agency (the data controller) for the processing of files related to people with disabilities. This software allowed users (data subjects) to upload their files and track their progress through an online portal.

Controllers Processors Processing

This software allowed users (data subjects) to upload their files and track their progress through an online portal. --- *This content has been automatically translated using machine translation. The original version is available in the source language.* --- *This content was automatically translated using machine translation. The original version is available in the source language.*

How it connects

1 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

Related across sources

Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address

C-340/21 VB v Natsionalna agentsia za prihodite C-340/21 (VB v Natsionalna agentsia) CJEU Dec 14, 2023 Integrity and Confidentiality Principle Data Breaches Notification Obligation

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data

S 5 SF 65/24 DS SG Nürnberg: MOVEit zero-day cyberattack via processor did not breach Art. 32 GDPR The data subject (a child born in 2018), represented by her parents, was insured with the controller (a statutory health insurance provider) and participated in its digital bonus… Social Court Nuremberg Jun 10, 2026 Processors Controllers Integrity and Confidentiality Principle

C-293/12 Digital Rights Ireland Ltd v Minister for Communications C-293/12 (Digital Rights Ireland) CJEU Apr 8, 2014 IP Address Storage Limitation Right to be Forgotten

C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer