French Data Protection Authority (CNIL) · 22 December 2025
NEXPUBLICA FRANCE
Insufficient technical and organisational measures to ensure information security
Fine€1,700,000Fine issued
- Regulator
- French Data Protection Authority (CNIL)
- Decided
- 22 December 2025
- Country
- France
- Sector
- Industry and Commerce
- Regulator’s reference
- Not recorded
- Fino case number
- 2025/FR/003
What happened
The DPA imposed a €1,700,000 fine to a processor who had incorrectly configured a software that processed files relating to persons with disabilities, leading to a massive data breach.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Data security
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2025/FR/003.