The 2023 CNIL report in summary

The National Commission for Information Technology and Liberties (CNIL) published its 2023 annual report on April 23, 2024, marking five years of implementation of the GDPR. This report highlights the actions of the CNIL in four major missions: informing and protecting the public, supporting and advising professionals, anticipating and innovating for the digital future, and control and sanction non-conformities.

Inform and protect

In 2023, the CNIL intensified its awareness-raising efforts. A new public awareness mission has been launched, reaching more than 2,500 people through conferences and workshops in six regions. In terms of digital education, the CNIL organized 81 interventions in nine regions, reaching 4,300 people, including 1,500 young people.

The CNIL has also recorded a sharp increase in complaints and public requests:

• 16,433 complaints have been processed (+35% compared to 2022).
• 20,810 requests indirect exercise of rights via a dedicated teleservice (+217%).
• 11.8 million visits on the CNIL website.

The CNIL responded to 47,111 calls during hotlines, demonstrating a growing interest in data protection, particularly on subjects such as phishing, cookies and artificial intelligence.

Support and advise

In 2023, the CNIL enriched its support approach, particularly in the field of artificial intelligence (AI). It launched the third edition of its "sandbox" for public service projects and supported innovative companies. The CNIL has also published 13 new reference documents: five guides, four benchmarks, two recommendations and two methodologies for the health sector.

GDPR days took place in Reims, Rennes, Marseille and Toulouse, strengthening regional support.

Anticipate and innovate

The CNIL has consolidated its links with the world of research by organizing Privacy Research Day, an international conference bringing together regulators and researchers. She published an AI roadmap, focusing on privacy, supporting innovative players and auditing existing systems.

Particular interest was paid to the intersection between data protection and the environment, materialized by the ninth LINC IP notebook, entitled "Data, footprint and freedoms". The air2023 ethics event was also a highlight, bringing together 1,700 participants.

Control and sanction

The repressive activity of the CNIL was supported in 2023 with 340 checks carried out, mainly on site and online. Among the 42 sanctions imposed (twice as many as in 2022), 36 were fines totaling 89,179,500 euros. In addition, the CNIL issued 168 formal notices and 33 reminders of legal obligations.

The simplified procedure, introduced in 2021 for cases without legal complexity, made it possible to impose 24 sanctions more efficiently.

Conclusion

The CNIL's 2023 annual report reflects a year marked by an increase in complaints, an intensification of awareness and support actions, and increased repression of non-compliance. The CNIL continues to play a crucial role in the protection of personal data in France, while anticipating future challenges linked to digital evolution.

For more details you can download the CNIL 2023 activity report and consult the 2024 edition of the CNIL in brief.