Content type · 98 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Country: France (50) Clear filter
Filter by Topic Supervisory Authorities3518 Processing Agreement2798 Processing2594 Personal Data2548 Controllers2165 Data Controller1854 Law Enforcement1541 IP Address1278 Security1007 Supervision854 Monitoring523 Consent498
CNIL · €5,000,000 IQVIA OPERATIONS FRANCE: Non-compliance with general data processing principles French Data Protection Authority (CNIL) fined IQVIA OPERATIONS FRANCE €5,000,000 on 2026-05-26 for: Non-compliance with general data processing principles. IP Address Processing Healthcare May 26, 2026
CNIL · €5,000,000 FRANCE TRAVAIL: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 5,000,000 on FRANCE TRAVAIL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures,… Security Health Data Healthcare Jan 22, 2026
CNIL · €27,000,000 FREE MOBILE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 27,000,000 on FREE MOBILE. The controller suffered a data breach due to insufficient technical and organisational measures. This was… Data Breaches Security Access Controls Jan 8, 2026
CNIL · €15,000,000 ONVOLDRAAGLIJK: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. De Franse autoriteit voor gegevensbescherming (CNIL) heeft FREE een boete van 15.000.000 euro opgelegd. Het bedrijf heeft een datalek geleden als gevolg van onvoldoende technische… Security Data Breaches Notification Obligation NL Jan 8, 2026
CNIL · €27,000,000 FREE MOBILE: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 27 miljoen euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). Security Data Breaches Access Controls NL Jan 8, 2026
CNIL · €15,000,000 FREE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 15,000,000 on FREE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by… Data Breaches Access Controls Telecommunications Jan 8, 2026
CNIL · €3,500,000 Company: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 3,500,000 on a company. The controller operated a loyalty program in France and 16 other EU countries, using customer data obtained… DPIA Processing Agreement Controllers Dec 30, 2025
CNIL · €1,700,000 NEXPUBLICA FRANKRIJK: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 1.700.000 euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). Security Controllers Data Controller NL Dec 22, 2025
CNIL · €1,700,000 NEXPUBLICA FRANCE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 1,700,000 on NEXPUBLICA FRANCE. The controller, who was a software developer, created and offered a software package designed to manage… Security Processing Agreement Controllers Dec 22, 2025
CNIL · €1,000,000 MOBIUS SOLUTIONS LTD: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 1,000,000 on MOBIUS SOLUTIONS LTD. The fined entity had been the former data processor for Deezer, which suffered a data breach in 2022.… Processors Data Breaches Controllers Dec 11, 2025
CNIL · €1,000,000 MOBIUS SOLUTIONS LTD: Niet-naleving van de algemene principes voor gegevensverwerking. 1.000.000 euro boete - Franse Autoriteit voor Gegevensbescherming (CNIL). Processors Controllers Processing NL Dec 11, 2025
CNIL · €1,500,000 AMERICAN EXPRESS CARTE FRANCE: Onvoldoende juridische basis voor de verwerking van gegevens. 1.500.000 euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). Cookies Controllers Personal Data NL Nov 27, 2025
CNIL · €1,500,000 AMERICAN EXPRESS CARTE FRANCE: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 1,500,000 on AMERICAN EXPRESS CARTE FRANCE. The controller used excessive cookies on its website and failed to adequately inform data… Cookies Controllers Processing Agreement Nov 27, 2025
CNIL · €750,000 LES PUBLICATIES CONDE NAST: Niet-naleving van algemene principes voor gegevensverwerking. Een boete van 750.000 euro - van de Franse Autoriteit voor Gegevensbescherming (CNIL). Cookies Telecommunications Processing NL Nov 20, 2025
CNIL · €750,000 LES PUBLICATIONS CONDE NAST: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 750,000 on LES PUBLICATIONS CONDE NAST. The controller used multiple cookies on its website but failed to adequately implement them. Cookies IP Address Telecommunications Nov 20, 2025
CNIL · €100,000 SAMARITAINE SAS: Niet-naleving van de algemene principes voor gegevensverwerking. Een boete van 100.000 euro - van de Franse Autoriteit voor Gegevensbescherming (CNIL). Security Data Breaches Supervisory Authorities NL Sep 18, 2025
CNIL · €100,000 SAMARITAINE SAS: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 100,000 on SAMARITAINE SAS. After multiple theft incidents, the controller installed security cameras disguised as smoke detectors to… Data Breaches Video Surveillance Monitoring Sep 18, 2025
CNIL · €125,000,000 GOOGLE IRELAND LIMITED: Onvoldoende juridische basis voor de verwerking van gegevens. 125.000.000 euro boete - Franse Autoriteit voor Gegevensbescherming (CNIL). Marketing Direct Marketing Cookies NL Sep 1, 2025
CNIL · €200,000,000 GOOGLE LLC: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 200,000,000 on GOOGLE LLC. While creating an account for the controller's services, the controller designed the cookie consent process in… Direct Marketing Cookies Marketing Sep 1, 2025
CNIL · €150,000,000 INFINITE STYLES SERVICES CO. LIMITED: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 150,000,000 on INFINITE STYLES SERVICES CO. LIMITED, which operates under the name 'SHEIN'. The controller used cookies unlawfully on its… Cookies Controllers Processing Agreement Sep 1, 2025
CNIL · €125,000,000 GOOGLE IRELAND LIMITED: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 125,000,000 on GOOGLE IRELAND LIMITED. While creating an account for the controller's services, the controller designed the cookie consent… Direct Marketing Cookies Marketing Sep 1, 2025
CNIL · €150,000,000 INFINITE STYLES SERVICES CO. LIMITED: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. 150 miljoen euro boete - Franse Autoriteit voor Gegevensbescherming (CNIL). Personal Data Cookies Processing NL Sep 1, 2025
CNIL · €200,000,000 GOOGLE LLC: Onvoldoende juridische basis voor de verwerking van gegevens. 200 miljoen euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). Marketing Consent Cookies NL Sep 1, 2025
CNIL · €900,000 SOLOCAL MARKETING SERVICES: Onvoldoende juridische basis voor gegevensverwerking. 900.000 euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). Data Controller Consent Controllers NL May 15, 2025
CNIL · €900,000 SOLOCAL MARKETING SERVICES: Insufficient legal basis for data processing The French DPA imposed a fine of EUR 900,000 on SOLOCAL MARKETING SERVICES. The controller, a company that also engages in direct marketing activities for its clients, ist using… Direct Marketing Controllers Processing Agreement May 15, 2025
CNIL · €80,000 CALOGA: Niet-naleving van algemene principes voor gegevensverwerking. Een boete van 80.000 euro - van de Franse Autoriteit voor Gegevensbescherming (CNIL). Processing Data Controller Marketing NL May 15, 2025
CNIL · €80,000 CALOGA: Non-compliance with general data processing principles The French DPA imposed a fine of EUR 80,000 on CALOGA. The controller is a company obtaining data from data brokers to use those for marketing purposes. The DPA found multiple… Controllers Processing Agreement IP Address May 15, 2025
CNIL · €40,000 Real estate company: Non-compliance with general data processing principles The French DPA imposed a fine of EUR 40,000 on a real estate company for inappropriately monitoring its employees. A software program recorded “periods of inactivity” and… DPIA Monitoring Audit Logs Feb 4, 2025
CNIL · €250,000 COSMOSPACE: Non-compliance with general data processing principles The French DPA imposed a fine of EUR 250,000 on COSMOSPACE. The controller is a company that offers personalized clairvoyance consultations by telephone. As part of its services,… Controllers Prior Consultation Processors Sep 26, 2024
CNIL · €150,000 TELEMAQUE: Non-compliance with general data processing principles The French DPA imposed a fine of EUR 150,000 on TELEMAQUE. The controller is a company that offers digital services in the field of divinatory arts, including fortune telling by… Controllers Telecommunications Processors Sep 26, 2024
CNIL · €800,000 CEGEDIM SANTÉ: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 800,000 on CEGEDIM SANTÉ. The company, which provides software for medical practices, had transferred customer data for research purposes.… Anonymization Processing Agreement Healthcare Sep 12, 2024
CNIL · €6,900 Municipality of Korou: Insufficient involvement of data protection officer The French DPA has imposed a fine of EUR 6,900 on the municipality of Korou for failing to appoint a data protection officer. Supervisory Authorities Public Authority Public Sector Jul 22, 2024
CNIL · €5,000 Bakery: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 5,000 on a bakery. The DPA found that the controller had violated its information obligations and the principle of data minimization in… Video Surveillance Controllers IP Address Jun 10, 2024
CNIL Company: Non-compliance with general data processing principles The French DPA has imposed a fine on a company operating a call center. The controller had systematically recorded all incoming and outgoing calls for training, evaluation and… Controllers IP Address Processing Agreement Jun 5, 2024
CNIL Company: Non-compliance with general data processing principles The French DPA has imposed a fine on a company. The company published a promotional video on its website and social networks in which images of patient files of one of its… Personal Data Direct Marketing IP Address Jun 5, 2024
CNIL FRANCE DPA: Insufficient cooperation with supervisory authority The French DPA has imposed a fine on a data controller for failing to cooperate sufficiently with the DPA. Supervisory Authorities Controllers Supervision Jun 5, 2024
CNIL FRANCE DPA: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine on a controller for not sufficiently respecting data subjects' rights (exercising the right of access to a medical file). Right of Access Procedures Right of Access Personal Data Jun 5, 2024
CNIL · €10,000 Association: Non-compliance with general data processing principles The French DPA has fined an association EUR 10,000 due to a lack of data security, non-compliance with the principle of data minimisation and a failure to comply with its… Retention Period Processing Agreement Security May 25, 2024
CNIL · €15,000 Association: Non-compliance with general data processing principles The French DPA has fined an association EUR 15,000 due to a lack of data security, non-compliance with the principle of data minimisation and a failure to comply with its… Retention Period IP Address Security May 25, 2024
CNIL · €6,000 Pubilc educational institution: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 6,000 on a public educational institution for violating the principle of data minimization and its information obligations unter the GDPR. Education Processing Agreement IP Address May 23, 2024
CNIL · €16,000 Association: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 16,000 on an association for processing personal data without a sufficient legal basis. Processing Agreement Personal Data Processing Apr 25, 2024
CNIL · €525,000 HUBSIDE.STORE: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 525,000 on HUBSIDE.STORE. The company had used data from data brokers for commercial acquisition campaigns without ensuring that the data… Processing Agreement Consent Personal Data Apr 4, 2024
CNIL · €5,000 Dentist: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 5,000 on a dentist due to a lack of data security and a failure to respect the right of access of a data subject. Right of Access Right of Access Procedures Personal Data Jan 31, 2024
CNIL · €10,000 FRANCE DPA: €10,000 fine The French DPA has imposed a fine of EUR 10,000 on a data controller due to data security vulnerabilities. Controllers Security Processing Agreement Jan 31, 2024
CNIL · €20,000 Website editor: €20,000 fine The French DPA has imposed a fine of EUR 20,000 on a website editor for data security vulnerabilities. Security Processing Agreement Supervisory Authorities Jan 31, 2024
CNIL · €20,000 Pharmaceutical wholesaler: €20,000 fine The French DPA has imposed a fine of EUR 20,000 on a pharmaceutical wholesaler due to violations of several regulations, including a lack of data security and insufficient… Controllers Accountability Processing Agreement Jan 24, 2024
CNIL · €32,000,000 AMAZON FRANCE LOGISTIQUE: Non-compliance with general data processing principles The French DPA (CNIL) has imposed a fine of EUR 32 million on AMAZON FRANCE LOGISTIQUE for unlawful surveillance of employees. CNIL found that Amazon France equips its warehouse… Video Surveillance Fairness & Transparency Monitoring Jan 23, 2024
CNIL · €500 Attorney: Insufficient cooperation with supervisory authority The French DPA has imposed a fine of EUR 500 on an attorney. The fine was imposed due to a lack of cooperation with the DPA. Supervisory Authorities Supervision Processing Agreement Jan 22, 2024
CNIL · €5,000 Attorney: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 5000 on an attorney. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of a request of erasure of… Right to be Forgotten Personal Data Supervisory Authorities Jan 15, 2024
CNIL · €1,500 Website operator: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 1,500 on a website operator. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of data subject… Data Subject Rights Exercise Modalities and Procedures Personal Data Supervisory Authorities Jan 9, 2024