France Data Protection & Privacy Regulation

Controller/Processor Duties

Two closures of enforcement injunctions illustrate how controller and processor compliance obligations in France are supervised through to resolution rather than remaining open-ended. The CNIL closed, by decision of 23 September 2026 and published 8 October 2026, the injunction order it had issued on 22 January 2026 against FRANCE TRAVAIL, the French public employment service. The closure confirms that the controller remedied the underlying issue identified in the original order, and the regulator did not proceed to liquidate the associated penalty payment, which stands as the clearest available indicator that compliance was achieved rather than merely asserted.

Separately, and by the same decision date, the regulator closed the injunction it had issued on 1 September 2025 against GOOGLE LLC and GOOGLE IRELAND LIMITED, publishing that closure on 14 October 2026. As with the FRANCE TRAVAIL matter, the closure was not accompanied by liquidation of the associated penalty, again consistent with a finding of remedied compliance. This matter sits within a wider context: it is understood to connect to parallel proceedings pursued by the Dutch data protection authority concerning automated decision-making practices at Uber, a connection that points to cross-border regulatory cooperation on overlapping controller obligations rather than two entirely unrelated enforcement tracks.

Taken together, these closures are best read as confirmation events rather than new findings of breach. They demonstrate that the CNIL's injunction mechanism functions through to a defined endpoint, where a controller that remedies the conduct identified in an order can expect the matter to close without further penalty, and that the regulator tracks such matters over periods spanning many months, as the gap between the original FRANCE TRAVAIL order in January 2026 and its closure in September 2026 illustrates. Neither closure discloses what specific remedial steps were taken by either controller, and no indication was found of any new injunction being issued against either of these controllers in the period under review.

The absence of any newly issued injunction or fresh controller-duties finding beyond these two closures should not be read as reduced regulatory attention; rather, these closures themselves represent the regulator working through its existing caseload of controller and processor compliance matters to a conclusion.

Outlook

Whether additional injunctions currently open against other controllers will close on a similarly extended timeline is not established from the material. The cross-border dimension visible in the Google-related matter, connecting to the Dutch authority's automated-decision-making proceedings against Uber, is worth continued attention as an indicator of how French and other European data protection authorities coordinate on shared controller-duties concerns involving multinational platforms.

Controller/Processor Duties

The CNIL fined HÔPITAL PRIVÉ DE LA LOIRE five hundred thousand euros on 3 September 2026 for failing to take appropriate measures to ensure the security of personal data, specifically patients' health data, a finding grounded in Article 32 of the GDPR. The sanction is confirmed by direct reference to the CNIL's own sanctions tag listing, a Tier 1 primary source, and sits at a materiality level the regulator reserves for security failures it regards as serious rather than merely technical.

The health-data context of this sanction gives it particular analytical weight. Article 32's security-of-processing obligation applies to all categories of personal data, but a failure that exposes special-category health data under Article 9 carries a different risk profile than an equivalent failure touching ordinary contact or transactional data: the potential for harm to data subjects is generally regarded as more severe, and regulators across the EU have tended to treat health-sector security failures as warranting proportionately higher fines. The five-hundred-thousand-euro quantum here, while below the seven-figure fines the CNIL has levied in its largest cases, is substantial for a single-controller security-measures case and signals continued regulatory attention to the health sector specifically.

This sanction is explicitly described in the underlying material as continuing a pattern rather than standing alone: it follows the CNIL's earlier, considerably larger sanction against France Travail, which the regulator's own enforcement cadence data situates within a broader run of approximately twenty-five sanctions and roughly thirty-five million euros in cumulative fines across 2026 to date. Read together, these two decisions, both grounded in security-of-processing failures rather than, for instance, consent or lawful-basis defects, suggest the CNIL's formation restreinte is currently prioritising Article 32 enforcement as a distinct enforcement line, separate from its historically larger focus on cookie-consent and direct-marketing matters.

A separate but related development this cycle is procedural rather than substantive: the European Data Protection Board, at its 17 September 2026 plenary, adopted guidelines on the power to impose administrative fines in relation to other corrective powers under the GDPR, alongside finalised guidelines on how GDPR fines interact with fines imposed under the Digital Services Act. This guidance is understood to bear on how the CNIL's own fine-calculation methodology is applied going forward, though no CNIL decision explicitly applying the new EDPB methodology has been identified as of this cycle. The HÔPITAL PRIVÉ DE LA LOIRE sanction, issued 3 September 2026, predates the EDPB's 17 September 2026 guideline adoption, so it cannot itself reflect the new methodology; any future test of the guidance's practical effect would need to be found in a subsequent CNIL decision.

Outlook

The principal item to track is whether the CNIL's formation restreinte applies the EDPB's newly adopted fining-methodology guidelines in a forthcoming decision, which would be the first concrete test of how the 17 September 2026 guidance translates into an actual French sanction calculation. More broadly, the continuation of the security-of-processing enforcement line opened by the France Travail sanction and extended by the HÔPITAL PRIVÉ DE LA LOIRE decision suggests further Article 32 sanctions, particularly in sensitive sectors such as health, are a plausible continuing feature of the CNIL's enforcement docket through the remainder of 2026.

Controller/Processor Duties

Two of this cycle's three major CNIL fines concern controller/processor security and accountability duties directly. CNIL fined France Travail €5 million on 22 January 2026 for failing to ensure the security of jobseekers' data; the central finding was that security measures identified in the organisation's own data protection impact assessments were never actually deployed into production, a gap between documented risk assessment and operational reality rather than an absence of risk assessment altogether. Separately, CNIL fined FREE MOBILE €27 million and FREE €15 million, a combined €42 million, on 13 January 2026, for inadequate security measures under Article 32, following an October 2024 breach that exposed approximately 24 million subscriber contracts including IBAN data.

Both actions concern the same underlying duty, adequate technical and organisational security measures, but manifest differently: the France Travail case is an accountability and DPIA-implementation failure, where the organisation had correctly identified the necessary controls but did not deploy them, while the Free/Free Mobile case is a security-measures failure that resulted in a large-scale breach involving financially sensitive IBAN data. The combined scale of these two sanctions, €47 million between them, is a significant enforcement signal for the accountability and security-measures dimension of France's data-protection regime this cycle.

Outlook

Whether CNIL's 2026 enforcement-priority focus on information and transparency, discussed under Enforcement & Redress, extends to further Article 32 security-measures or Article 35 DPIA-implementation actions is the key marker to watch for this module next cycle.

Sectoral Watch

The EU Data Act's design-for-access obligation under Article 3(1) took effect on 12 September 2026. From that date, connected products and related services placed on the market must be designed and manufactured so that the data they generate is, by default, easily, securely and directly accessible to the user free of charge. This is a confirmed, Tier 1-sourced application milestone, drawn directly from the CNIL's own published guidance on the Data Act, and it represents a substantive new obligation now binding on manufacturers and providers of connected products placed on the French and wider EU market from that date forward.

What is notably incomplete, however, is the national enforcement architecture that would give this obligation domestic teeth in France specifically. The Data Act required Member States to notify the European Commission of their national administrative-penalty amounts for breaches of the Chapter III obligations, including the Article 3(1) design-for-access duty, by 12 September 2025. France is understood, per secondary commentary, to have missed that notification deadline. The implementing legislation intended to establish France's national penalty framework, the DDADUE bill, was adopted by the Senate on 18 February 2026 but remained before the National Assembly as of 27 September 2026, meaning more than a year after the original Commission notification deadline, France still had not completed its domestic implementing legislation.

The practical consequence of this gap is a split regulatory position: the substantive obligation itself, the design-for-access duty under Article 3(1), is directly applicable EU law and is binding in France regardless of domestic implementing legislation, since the Data Act is a regulation rather than a directive. What remains unsettled is specifically the national administrative-penalty regime: the quantum and mechanism of domestic sanctions for breach of the Chapter III obligations cannot be finalised in France until the DDADUE bill completes its passage through the National Assembly and is enacted. This is analytically significant because it illustrates a now-familiar pattern in EU regulation-based (as opposed to directive-based) data-law instruments: the substantive obligation arrives on schedule because it requires no domestic transposition, while the enforcement architecture lags because administrative-penalty frameworks typically do require national implementing legislation.

No information was identified this cycle regarding whether the European Commission has taken any formal step in response to France's apparent missed notification deadline, nor whether any other Member State's implementing legislation has progressed further. The current state of the record is limited to the Senate's 18 February 2026 adoption of the DDADUE bill and its status before the National Assembly as of 27 September 2026, with no further legislative milestone identified since that date within this cycle's research.

Outlook

The DDADUE bill's progress through the National Assembly is the single most consequential item to track in this domain: until it is enacted, France's national administrative-penalty amounts for Data Act Chapter III obligations, including the Article 3(1) design-for-access duty now in force since 12 September 2026, remain unsettled even though the underlying substantive obligation is already binding under directly-applicable EU law. A further item worth monitoring is whether the European Commission takes any visible step in response to France's apparent missed 12 September 2025 notification deadline, which would be the first indication of how the Commission is treating Member States that have fallen behind on Data Act implementing legislation.

Sectoral Watch

CNIL fined IQVIA Operations France €5 million on 26 May 2026 for failing to respect guarantees limiting risks to individuals in its management of a health-data warehouse. This is a sector-specific enforcement signal concerning the particular safeguards expected of health-data-warehouse operators, a category of controller handling especially sensitive categories of personal data at scale, and is distinct from the general-purpose security and accountability findings addressed elsewhere this cycle.

The health-data-warehouse context carries heightened regulatory expectations precisely because of the sensitivity and scale of the data involved, and this fine indicates CNIL is prepared to enforce those heightened guarantees with fines of the same order of magnitude as its general Article 32 security-measures actions this cycle. The finding stands alongside the France Travail and Free/Free Mobile fines as one of three major 2026 CNIL sanctions identified this cycle, together forming the basis for the assessment that CNIL's enforcement posture has structurally intensified in 2026 relative to prior years.

Outlook

Whether further health-sector-specific enforcement actions follow the IQVIA fine, and whether CNIL articulates sector-specific guidance for health-data-warehouse operators in response, are the developments to watch for this module next cycle.

AdTech & Commercial Privacy

CNIL's final recommendation on email tracking pixels, published 14 April 2026, set a hard compliance deadline: organisations were required to obtain explicit consent from existing subscribers, or stop tracking them, by 14 July 2026, with no transitional period at all for contacts collected from 14 April 2026 onward. As of the current cycle, that deadline has passed, meaning any organisation that had not obtained the required explicit consent by 14 July 2026 is now operating outside CNIL's stated compliance expectation for email-tracking-pixel use.

The absence of a transitional period for newly-collected contacts is a notably strict feature of the recommendation relative to typical phased-implementation approaches, since it applies the full consent requirement immediately to any contact acquired after the recommendation's publication date, even though the overall compliance deadline for existing subscribers extended a further three months. This recommendation reflects CNIL's continuing focus on granular consent mechanics in commercial email and tracking contexts, consistent with its broader 2026 enforcement-priority theme of information and transparency obligations.

Outlook

The key marker to watch is whether CNIL follows the passed 14 July 2026 deadline with enforcement action against organisations found not to have obtained the required consent, which would be the first concrete enforcement test of this specific recommendation.

Algorithmic, Biometric & Surveillance Governance

The most forward-looking signal in France's data protection environment concerns the CNIL's anticipated role under the European Union's AI Act. Secondary reporting on the regulator's 2026 programme of controls describes the CNIL preparing to be designated as market-surveillance authority for a subset of high-risk artificial intelligence systems. This designation, as reported, is understood to be contingent on the French law implementing the AI Act domestically, meaning the CNIL's formal authority in this space has not yet crystallised and remains dependent on a legislative step that has not been independently confirmed as complete.

The claim is carried at probable rather than confirmed confidence, reflecting that it rests on commentary describing the regulator's work programme rather than on the CNIL's own primary programme document, which was not independently re-verified. This distinction matters for how the development should be read: it describes a regulator positioning itself for an anticipated role, not a regulator that has already assumed formal market-surveillance powers over high-risk artificial intelligence systems.

If and when this designation takes effect, it would place the CNIL in a position with direct relevance to the governance of algorithmic systems more broadly, extending the regulator's institutional reach from its traditional personal-data protection mandate into supervision of a subset of high-risk artificial intelligence systems as defined under the EU framework. The scope of that subset, and the precise boundary between the CNIL's prospective market-surveillance role and the roles of other French and European authorities with overlapping competence in artificial intelligence oversight, was not detailed in the material available.

No related finding on biometric data processing or surveillance-specific instruments was identified in France beyond this preparatory AI Act posture. The signal here is institutional and anticipatory rather than a concrete new rule or enforcement action.

Outlook

The CNIL's path toward a formal AI Act market-surveillance designation depends on the French implementing law, and confirmation of that designation, once the implementing legislation is in place, would be a more concrete development than the preparatory posture recorded. Readers tracking the interaction between data protection and artificial intelligence oversight in France should expect the precise boundaries of the CNIL's prospective role to become clearer once the implementing law and the regulator's own published programme can be independently reviewed.

Enforcement & Redress

France's data protection enforcement activity is characterised by confirmation rather than new sanction. The CNIL closed two separate injunction proceedings by decision of 23 September 2026: one against FRANCE TRAVAIL, closing the order originally issued 22 January 2026 and published 8 October 2026, and one against GOOGLE LLC and GOOGLE IRELAND LIMITED, closing the order originally issued 1 September 2025 and published 14 October 2026. In both instances, the regulator did not proceed to liquidate the penalty payment that had been attached to the original injunction, which is the strongest available signal that the underlying controllers had come into compliance by the time of closure.

The Google-related closure is notable for its connection to a substantially larger enforcement action: the Dutch data protection authority, in cooperation with the CNIL, imposed a fine understood to be in the region of eight hundred and twenty-five million euros on UBER B.V. and UBER TECHNOLOGIES INC. for breaches related to automated decision-making, published 24 August 2026. While that fine falls outside the strict window of the own findings, it is carried forward here as recent context because it illustrates the scale of cross-border cooperative enforcement that French and Dutch authorities are capable of pursuing jointly on matters of overlapping concern, and because the CNIL's injunction closure against Google sits within the same broader automated-decision-making enforcement landscape.

Taken as a pair, the two injunction closures signal an active, functioning enforcement pipeline in France: orders are issued, controllers are given the opportunity to remedy the underlying issue, and the regulator confirms closure once remediation is verified. No new sanction decision dated within the window was identified, and the absence of a new penalty should be read in that light, as a feature of the compliance-confirmation process rather than a gap in enforcement activity.

Outlook

The pattern of injunction closure without penalty liquidation observed in both matters suggests a functioning remediation-and-confirmation enforcement model; continued monitoring of whether other open injunctions in the French pipeline follow a similar closure pattern will help establish whether this is the regulator's consistent practice. The scale of the related Uber fine pursued jointly with the Dutch authority underscores that France's cross-border enforcement cooperation on automated-decision-making matters can produce outcomes of very substantial magnitude, even where the French regulator's own direct action in a given matter, as with the Google closure, resolves without a new penalty.

Enforcement & Redress

The CNIL's enforcement cadence remained elevated this cycle, anchored by the five-hundred-thousand-euro sanction against HÔPITAL PRIVÉ DE LA LOIRE on 3 September 2026 for security-of-processing failures affecting patients' health data. This sanction, confirmed via the CNIL's own primary sanctions listing, continues a pattern the regulator set with its considerably larger five-million-euro sanction against France Travail earlier in 2026, and sits within a broader run described in independent tracking as approximately twenty-five sanctions totalling roughly thirty-five million euros across 2026 to date. Whatever the precision of that aggregate figure, which derives from secondary commentary rather than a CNIL-published total, the pattern of two substantial, security-focused sanctions within a single year is itself a confirmed, primary-sourced feature of this cycle's enforcement record.

Alongside this substantive sanction, the CNIL closed a procedural matter: by deliberation dated 17 September 2026, the regulator formally closed the cookie-consent injunction it had originally imposed on SOLOCAL MARKETING SERVICES on 15 May 2025. This is a lower-materiality item than the HÔPITAL PRIVÉ DE LA LOIRE sanction, representing the resolution of a prior enforcement matter rather than a new finding of breach, but it is a confirmed, Tier 1-sourced data point in the CNIL's ongoing enforcement docket and indicates the regulator continues to actively manage and close out its injunction caseload rather than leaving matters open indefinitely.

A third item relevant to this domain is procedural and forward-looking rather than a completed enforcement action: the European Data Protection Board's adoption, at its 17 September 2026 plenary, of guidelines on the power to impose administrative fines in relation to other corrective powers under the GDPR, together with finalised guidelines on the interaction between GDPR fines and Digital Services Act fines. This guidance is understood to shape how the CNIL's formation restreinte calculates future fines, though its practical effect cannot yet be assessed since no CNIL decision applying the new methodology had been identified as of this cycle, and the HÔPITAL PRIVÉ DE LA LOIRE sanction itself predates the guideline's 17 September 2026 adoption by two weeks.

Taken together, these three items describe a CNIL enforcement posture this cycle that is simultaneously active on substantive sanctions, methodical about closing out resolved procedural matters, and operating under a fine-calculation framework about to be reshaped by new EDPB guidance whose practical application remains untested.

Outlook

The clearest forward-looking marker for this domain is whether a future CNIL sanction decision visibly applies the EDPB's 17 September 2026 fining-methodology guidelines, which would be the first concrete evidence of how that guidance changes French fine calculation in practice. Separately, given the pattern of two substantial security-of-processing sanctions already recorded in 2026, continued CNIL attention to Article 32 compliance, particularly in sensitive sectors such as health, remains a plausible feature of the enforcement docket through the remainder of the year.

Enforcement & Redress

This cycle's enforcement activity in France is defined by the concurrence of at least three major CNIL fines: €42 million combined against FREE MOBILE and FREE (13 January 2026), €5 million against France Travail (22 January 2026), and €5 million against IQVIA Operations France (26 May 2026). Measured against CNIL's full historical enforcement record of 83 sanctions totalling approximately €486.8 million since GDPR's entry into force, these three 2026 actions together total roughly €52 million within a single reporting period, a concentration that exceeds typical historical annual norms and signals a structurally more aggressive enforcement posture rather than a one-off episodic spike.

CNIL has named information and transparency obligations as its 2026 enforcement-priority theme, mirroring the EDPB's designated focus theme for the year. This forward-looking signal suggests that the three fines already identified this cycle, which concern security measures and DPIA implementation rather than transparency specifically, may be followed by a distinct wave of transparency-focused enforcement action later in 2026, rather than representing the totality of CNIL's enforcement focus for the year.

Outlook

Whether CNIL's transparency-focused enforcement priority materialises into further sanctions in the second half of 2026, and whether the pace of large fines observed in January and May continues, are the two developments most likely to confirm or revise the assessment that CNIL's enforcement posture has structurally intensified.