France

FRANCE TRAVAIL

5,000,000 €

GDPR enforcement action by French Data Protection Authority (CNIL) on 2026-01-22.

Rank · Sector

of 357 in Public Sector and Education

Rank · France

#14

of 74

Rank · All fines

#75

of 3,050

Case details

Authority: French Data Protection Authority (CNIL)
Date: 2026-01-22
Controller / Processor: FRANCE TRAVAIL
Sector: Public Sector and Education
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The French DPA has imposed a fine of EUR 5,000,000 on FRANCE TRAVAIL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures, resulting in the leak of personal and special category data concerning 38,820,828 individuals. The attack was carried out using the 'social engineering' method, meaning that the attacker obtained goods or information by exploiting the trust, ignorance or credulity of third parties.

Open original source Links to the regulator's original publication or another source.