The AI, Cyber & Data return: what you shouldn't have missed (September 2025 Newsletter)

16 sept 2025 · By Aymeric Guyard · 5 min read

In brief

The EU General Court confirmed the validity of the Data Privacy Framework on 3 September 2025.
Google (€325m) and Shein (€150m) sanctioned by the CNIL for placing cookies without clear consent.
The Data Act enters into force on 12 September 2025, opening up users' access to their IoT data.

🚨 Cyberattacks in France (August 2025)

The month of August once again demonstrated just how vulnerable French businesses remain to hackers. Here are some of the attacks recorded:

Sneg Propreté – Professional cleaning services (26 August).
Selartex – Textile wholesale (23 August).
Peggy Sage – Cosmetics and beauty (15 August).
SMEF Azur – Climate engineering and installations (14 August).
Orange France – Telecommunications and digital services (17 August).
Pansard & Associés – Law firm (6 August).
Afpa – Vocational training and integration (6 August).
FranceLink – Digital services (13 August).

💡 These attacks serve as a reminder that all businesses, large or small, can be targeted. Cybersecurity is no longer optional—it's essential. Protect your organisation and raise your teams' awareness of cybersecurity; discover our eLearning courses.

🌍 Data Privacy Framework: data transfers to the US validated (again)

For a long time, European businesses were unsure whether they could transfer their data to US providers (e.g. cloud hosts, collaborative tools). Several agreements have been invalidated in the past (Safe Harbor in 2015, Privacy Shield in 2020).

Good news: on 3 September 2025, the EU General Court confirmed the validity of the Data Privacy Framework (DPF). In practical terms:

Transfers to the US are still permitted.
Businesses can work with DPF-certified US providers.
But proceed with caution: the decision may be challenged.

💡 The DPO's role is precisely to anticipate: keep a plan B (Standard Contractual Clauses) and stay informed to avoid unpleasant surprises.

📅 Data Act: a new right over your data

Our connected devices (watches, cars, electricity meters, industrial machinery, etc.) continuously collect valuable information. Until now, only the manufacturers had access to it.

From 12 September 2025, the Data Act changes everything:

Users (individuals or businesses) will have direct access to their data.
They will be able to share it with third parties (other businesses, public authorities, etc.).
SMEs will be protected against unfair contract terms.
Cloud providers will have to guarantee portability (switching provider will be simpler).

⚖️ GDPR + Data Act: two complementary texts.

The GDPR protects personal data (name, email, health, etc.).
The Data Act targets technical and industrial data.

Result: data becomes an economic asset that everyone can exploit.

🍪 CNIL: Google and Shein sanctioned for cookie misuse

Advertising cookies remain a priority for CNIL enforcement. In early September:

Google: €325 million fine for inserting advertising in Gmail and placing cookies without clear consent.
Shein: €150 million fine for placing advertising cookies before obtaining consent and deliberately making refusal complicated.

The message is simple:

Cookies must be freely accepted or refused.
Information must be clear and understandable.
No business is safe, whether it's a Big Tech company or an SME.

⚖️ Anonymous or personal data? The CJEU clarifies

On 4 September 2025, the Court of Justice of the EU clarified the difference between pseudonymised data and anonymous data:

For the holder of the key (e.g. a hospital), the data remains personal.
For someone who receives pseudonymised data without being able to re-identify (e.g. a researcher), it may be considered anonymous.

This opens up prospects for innovation: researchers and businesses can reuse certain data more freely, provided they can prove that re-identification is not possible.

💳 Data breaches and IBAN theft: how to respond?

Data breaches are increasing. They may involve:

your IBAN (fraudulent direct debits possible),
your identity (credit accounts opened in your name),
your online accounts (hacking via phishing or SIM-swapping).

💡 Immediate actions:

Monitor your bank accounts.
Change your priority passwords.
Enable two-factor authentication (2FA).
File a complaint in the event of fraud.

For businesses:

Quickly block compromised accounts.
Alert your bank.
Notify the CNIL within 72 hours if personal data is concerned.

🤖 AI Act: what's changed since 2 August 2025

Businesses that develop general-purpose artificial intelligence and those that modify and reuse such AI to place it on the market must now play open cards: explain how they were trained, with what data, and prove that they comply with copyright law. If an AI is deemed too risky, it will be under special surveillance: security testing, constant monitoring, and an obligation to report any issues.

Even businesses outside Europe must have an official representative in Europe to respond to the authorities.

Each EU country must designate supervisors to verify that the rules are being followed. Rather than a single authority, France is entrusting AI supervision to around fifteen bodies already competent by sector (health, finance, education, audiovisual, etc.). Coordination will be managed by the DGCCRF (market surveillance) and the DGE (strategic coordination and representation to the EU). The CNIL will handle uses related to personal data, Arcom digital content, and other specialised regulators will intervene in their respective fields. A system based on specialisation, but which may appear complex.

💡 Businesses using AI must also remain vigilant:

Verify the compliance of their AI suppliers.
Frame contracts with transparency and accountability clauses.
Train their teams on AI issues.

Need clarity? Schedule a free discussion with one of our experts

🔒 NIS2: transposition further delayed in France

The European NIS2 directive, which imposes new cybersecurity obligations on several thousand organisations in France (health, energy, digital, finance, etc.), is seeing its timetable postponed once again.

The reason: government instability. The law was due to be examined in September, but the fall of the Bayrou government has delayed the process. Result: almost a year's delay already.