--- title: "France — Controller/Processor Duties | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/france/controller-processor-duties/ source_html: /jurisdictions/france/controller-processor-duties/index.html description: "France — Controller/Processor Duties: controller_processor_duties Controller/Processor Duties 7 sub-modules Green ▾ # Extensive, recent (2025-2026) CNIL sanction practice directly evidences most sub-modules; ROPA remains a" generated_at: 2026-10-25T04:46:50Z content_sha256: 9624c7c07d3612efbd96240342ea6a5efe4d76105203107e5f88a8b6006d604e generator: "fe-fleet/md-twin@1.0" --- # France — Controller/Processor Duties | Data Protection Monitor ### D4Controller/Processor Duties7 sub-modulesGreen▾# Extensive, recent (2025-2026) CNIL sanction practice directly evidences most sub-modules; ROPA remains a gap. Primary framework GDPR Arts 5, 24, 25, 28, 30, 32-35, 37-39 Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Green Extensive, recent (2025-2026) CNIL sanction practice directly evidences most sub-modules; ROPA remains a gap. #### Sub-modules (7) #### Accountability And DpiaAmber FRANCE TRAVAIL's DPIAs had identified necessary security measures that were never actually implemented, a factor in its €5m fine. Claims (1): - CLM-FR-a1000eg4 (claim on file) #### Dpo RequirementsGreen DPO designation is mandatory for public bodies, large-scale-monitoring organisations (banks, insurers, telecoms/ISPs) and large-scale sensitive-data processors; non-designation risks fines up to €10m/2% turnover, and CNIL has issued public mises en demeure to non-compliant communes. Claims (3): - CLM-FR-a1000fh5 (claim on file) - CLM-FR-a10010i6 (claim on file) - CLM-FR-a10011j7 (claim on file) #### Ropa RequirementsRed No FR-specific ROPA enforcement or guidance was surfaced in this cycle beyond the standard GDPR Art 30 baseline. Absence provenance: unavailable . Searched: unavailable . #### Joint Controller ArrangementsGreen CNIL treated FREE MOBILE and FREE as separate controllers each responsible for its own subscriber data despite corporate affiliation. Claims (1): - CLM-FR-a10012k8 (claim on file) #### Security MeasuresAmber Article 32 GDPR breaches (NEXPUBLICA's structural security weaknesses processing disability data) attract multi-million-euro fines. Claims (1): - CLM-FR-a10013l9 (claim on file) #### Breach NotificationAmber CNIL sanctioned incomplete Article 34(2) breach notifications to affected FREE/FREE MOBILE subscribers. Claims (1): - CLM-FR-a10014m0 (claim on file) #### Retention And DisposalAmber FREE failed to sort and delete former-subscriber data once no longer needed for accounting purposes. Claims (1): - CLM-FR-a10015n1 (claim on file) Category narrative 40 words CNIL's 2026 enforcement wave (FREE MOBILE/FREE, FRANCE TRAVAIL, IQVIA, NEXPUBLICA) evidences active application of accountability/DPIA, DPO, joint-controller, security, breach-notification and retention obligations under GDPR Arts 5, 24, 25, 28, 30, 32-35, 37-39. ROPA-specific findings were not separately evidenced this cycle. Periodic update · new data 2026-10-20 #### Controller/Processor Duties Two closures of enforcement injunctions illustrate how controller and processor compliance obligations in France are supervised through to resolution rather than remaining open-ended. The CNIL closed, by decision of 23 September 2026 and published 8 October 2026, the injunction order it had issued on 22 January 2026 against FRANCE TRAVAIL, the French public employment service. The closure confirms that the controller remedied the underlying issue identified in the original order, and the regulator did not proceed to liquidate the associated penalty payment, which stands as the clearest available indicator that compliance was achieved rather than merely asserted. Separately, and by the same decision date, the regulator closed the injunction it had issued on 1 September 2025 against GOOGLE LLC and GOOGLE IRELAND LIMITED, publishing that closure on 14 October 2026. As with the FRANCE TRAVAIL matter, the closure was not accompanied by liquidation of the associated penalty, again consistent with a finding of remedied compliance. This matter sits within a wider context: it is understood to connect to parallel proceedings pursued by the Dutch data protection authority concerning automated decision-making practices at Uber, a connection that points to cross-border regulatory cooperation on overlapping controller obligations rather than two entirely unrelated enforcement tracks. Taken together, these closures are best read as confirmation events rather than new findings of breach. They demonstrate that the CNIL's injunction mechanism functions through to a defined endpoint, where a controller that remedies the conduct identified in an order can expect the matter to close without further penalty, and that the regulator tracks such matters over periods spanning many months, as the gap between the original FRANCE TRAVAIL order in January 2026 and its closure in September 2026 illustrates. Neither closure discloses what specific remedial steps were taken by either controller, and no indication was found of any new injunction being issued against either of these controllers in the period under review. The absence of any newly issued injunction or fresh controller-duties finding beyond these two closures should not be read as reduced regulatory attention; rather, these closures themselves represent the regulator working through its existing caseload of controller and processor compliance matters to a conclusion. #### Outlook Whether additional injunctions currently open against other controllers will close on a similarly extended timeline is not established from the material. The cross-border dimension visible in the Google-related matter, connecting to the Dutch authority's automated-decision-making proceedings against Uber, is worth continued attention as an indicator of how French and other European data protection authorities coordinate on shared controller-duties concerns involving multinational platforms. 2 earlier distinct update(s) Periodic update · new data 2026-10-06 #### Controller/Processor Duties The CNIL fined HÔPITAL PRIVÉ DE LA LOIRE five hundred thousand euros on 3 September 2026 for failing to take appropriate measures to ensure the security of personal data, specifically patients' health data, a finding grounded in Article 32 of the GDPR. The sanction is confirmed by direct reference to the CNIL's own sanctions tag listing, a Tier 1 primary source, and sits at a materiality level the regulator reserves for security failures it regards as serious rather than merely technical. The health-data context of this sanction gives it particular analytical weight. Article 32's security-of-processing obligation applies to all categories of personal data, but a failure that exposes special-category health data under Article 9 carries a different risk profile than an equivalent failure touching ordinary contact or transactional data: the potential for harm to data subjects is generally regarded as more severe, and regulators across the EU have tended to treat health-sector security failures as warranting proportionately higher fines. The five-hundred-thousand-euro quantum here, while below the seven-figure fines the CNIL has levied in its largest cases, is substantial for a single-controller security-measures case and signals continued regulatory attention to the health sector specifically. This sanction is explicitly described in the underlying material as continuing a pattern rather than standing alone: it follows the CNIL's earlier, considerably larger sanction against France Travail, which the regulator's own enforcement cadence data situates within a broader run of approximately twenty-five sanctions and roughly thirty-five million euros in cumulative fines across 2026 to date. Read together, these two decisions, both grounded in security-of-processing failures rather than, for instance, consent or lawful-basis defects, suggest the CNIL's formation restreinte is currently prioritising Article 32 enforcement as a distinct enforcement line, separate from its historically larger focus on cookie-consent and direct-marketing matters. A separate but related development this cycle is procedural rather than substantive: the European Data Protection Board, at its 17 September 2026 plenary, adopted guidelines on the power to impose administrative fines in relation to other corrective powers under the GDPR, alongside finalised guidelines on how GDPR fines interact with fines imposed under the Digital Services Act. This guidance is understood to bear on how the CNIL's own fine-calculation methodology is applied going forward, though no CNIL decision explicitly applying the new EDPB methodology has been identified as of this cycle. The HÔPITAL PRIVÉ DE LA LOIRE sanction, issued 3 September 2026, predates the EDPB's 17 September 2026 guideline adoption, so it cannot itself reflect the new methodology; any future test of the guidance's practical effect would need to be found in a subsequent CNIL decision. #### Outlook The principal item to track is whether the CNIL's formation restreinte applies the EDPB's newly adopted fining-methodology guidelines in a forthcoming decision, which would be the first concrete test of how the 17 September 2026 guidance translates into an actual French sanction calculation. More broadly, the continuation of the security-of-processing enforcement line opened by the France Travail sanction and extended by the HÔPITAL PRIVÉ DE LA LOIRE decision suggests further Article 32 sanctions, particularly in sensitive sectors such as health, are a plausible continuing feature of the CNIL's enforcement docket through the remainder of 2026. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Two of this cycle's three major CNIL fines concern controller/processor security and accountability duties directly. CNIL fined France Travail €5 million on 22 January 2026 for failing to ensure the security of jobseekers' data; the central finding was that security measures identified in the organisation's own data protection impact assessments were never actually deployed into production, a gap between documented risk assessment and operational reality rather than an absence of risk assessment altogether. Separately, CNIL fined FREE MOBILE €27 million and FREE €15 million, a combined €42 million, on 13 January 2026, for inadequate security measures under Article 32, following an October 2024 breach that exposed approximately 24 million subscriber contracts including IBAN data. Both actions concern the same underlying duty, adequate technical and organisational security measures, but manifest differently: the France Travail case is an accountability and DPIA-implementation failure, where the organisation had correctly identified the necessary controls but did not deploy them, while the Free/Free Mobile case is a security-measures failure that resulted in a large-scale breach involving financially sensitive IBAN data. The combined scale of these two sanctions, €47 million between them, is a significant enforcement signal for the accountability and security-measures dimension of France's data-protection regime this cycle. #### Outlook Whether CNIL's 2026 enforcement-priority focus on information and transparency, discussed under Enforcement & Redress, extends to further Article 32 security-measures or Article 35 DPIA-implementation actions is the key marker to watch for this module next cycle. Evidence 0 — none recorded