TL;DR for the DPO
The French simplified procedure is designed for straightforward cases: fast investigation, modest amount, and in most cases no naming. The message for anyone advising SMEs is that the authorities' attention threshold has dropped: you no longer need to be large to end up in a decision.
The three infringements that keep coming back
- Excessive video surveillance: cameras filming workstations continuously, break areas, or the public pavement. It is the most frequent infringement in small businesses, and it almost always starts with an installer pointing the lens where it is convenient rather than where it is lawful.
- Non-compliant cookie banners: refusing is not as easy as accepting, trackers fire before any choice, withdrawal is missing. The CNIL has been consistent on this for years and other authorities have followed.
- Failure to respond to access and erasure requests: the most mundane and the most avoidable. Ignoring a data subject produces a complaint, and the complaint opens an investigation into everything else.
Why it matters more than the figure
A controller reading EUR 133,750 spread across twenty-three decisions may conclude the financial risk is negligible. That reading is short-sighted for two reasons. First: the simplified procedure is fast, so the number of decisions per year rises while the authority's effort per case falls. Second: an investigation does not stop at what triggered it. A complaint about an ignored erasure request leads the authority to look at the records, the notices and the cookies, and the final penalty adds up things the controller did not know it had to defend.
What to do now, with small clients
1) Video surveillance: ask for photographs of what each camera actually frames, not the installation diagram. The gap between those two documents is where the fines live. 2) Cookies: open the client's site in a private window and count the clicks needed to refuse. If it is more than to accept, that alone is a non-compliance. 3) Data subject requests: check there is an address someone actually reads, and a request log with dates. 4) Remind the client that the cost of a decision is not the fine: it is the weeks of investigation and the documents you discover are missing while you face it.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
