Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Enforcement June 9, 2026 6 min

France: CNIL fines France Travail EUR 5 million - 36.8 million data subjects and a social-engineering attack

January 2026 - the public employment agency sanctioned for inadequate security under Art. 32. Attackers got in by tricking staff, not by breaching systems

TL;DR for the DPO

22 January 2026: France's CNIL fines France Travail (the public employment agency) EUR 5,000,000. A social-engineering attack in Q1 2024 compromised the accounts of Cap Emploi advisers (who support people with disabilities) and exposed the data of around 36.8 million people registered over the last 20 years. The fine is for breaching Art. 32 GDPR (security), not for the attack itself.

The facts

In Q1 2024 attackers infiltrated France Travail's information system not via a technical vulnerability but through social engineering: they tricked Cap Emploi advisers and hijacked their accounts, gaining access to data of everyone registered over the past 20 years. The CNIL found the technical and organisational measures did not sufficiently reduce the risk of unauthorised access through compromised accounts.

5MEUR
CNIL fine
36.8M
Data subjects affected

The point: an obligation of means

The CNIL reiterated that Art. 32 is an obligation of means: measures must be demonstrable and risk-appropriate. 'We had plans' is not a defence if the controls were not actually live in production. For a public body the fine is not based on turnover: the cap for a security breach is EUR 10 million.

Official source:CNIL - Data breach: France Travail fined 5 million

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Enforcement
€16,7Mfor telemarketing and contracts activated without consent

Italian DPA fines Wind Tre €16.7 million: telemarketing despite objections and contracts activated without customers' knowledge

People who had objected kept receiving calls, and some contracts were activated without the person knowing. The Garante fines Wind Tre €16.7 million and restates a principle for every company with an agency network: responsibility is not outsourced along with sales.

Oct 12, 2026New 5 min
Enforcement
€350kto controller and processor over outdated systems

Greece: €350,000 for a data breach — both the Ministry and the processor running outdated systems fined, and there was no Article 28 contract

An attack on the systems of the agency running a Ministry's programmes exposed identification, financial and health data of a very large number of people. The Hellenic DPA fines the controller €200,000 and the processor €150,000: notifying well is not enough if the supplier works on outdated systems and the relationship is not governed by a contract.

Oct 08, 2026New 5 min
Enforcement
€4kfor a camera pointed at a home

Italian DPA fines the municipality of Arvier €4,000: a camera filmed a resident's windows and balconies, and the masking came too late

A small municipality in the Aosta Valley uses cameras for traffic, parking, number plates, the environment and civil protection. A resident finds that one covers her home. The Garante imposes a fine and makes a point that applies to every system: masking private areas is designed before the camera is switched on, not after the complaint.

Oct 08, 2026New 5 min