Sanction RGPD French Data Protection Authority (CNIL) — FRANCE TRAVAIL : 5,0 M€ (2026)
- Autorité de contrôle
- French Data Protection Authority (CNIL)
- Pays
- France
- Entreprise / secteur
- FRANCE TRAVAIL
- Montant de l'amende
- 5,0 M€
- Date de la décision
- 22 janvier 2026
- Fondement juridique
- Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The French DPA has imposed a fine of EUR 5,000,000 on FRANCE TRAVAIL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures, resulting in the leak of personal and special category data concerning 38,820,828 individuals. The attack was carried out using the 'social engineering' method, meaning that the attacker obtained goods or information by exploiting the trust, ignorance or credulity of third parties.