#
Very well evidenced, high-materiality enforcement activity across multiple 2025-2026 decisions plus recent 180-day developments.
Sub-modules (6)
Regulator Powers And PenaltiesGreen
CNIL's restricted committee imposes fines, mises en demeure and injunctions with daily penalty payments (e.g., €5,000/day FRANCE TRAVAIL, €10,000/day IQVIA); public-sector security-breach fines are capped at €10m rather than turnover-based.
Claims (2):
- CLM-FR-a10035h1 (claim on file)
- CLM-FR-a10036i2 (claim on file)
Enforcement Activity IndexGreen
2025 total sanctions of €486,839,500; 2026 sanctions to date include Free Mobile/Free (€42m combined), FRANCE TRAVAIL (€5m), IQVIA (€5m) and NEXPUBLICA (€1.7m).
Claims (1):
- CLM-FR-a10037j3 (claim on file)
Regulator Funding And CapacityAmber
CNIL processed 539 health-authorisation applications in 2025 alone, indicating substantial specialised operational capacity.
Claims (1):
- CLM-FR-a10038k4 (claim on file)
Collective Redress And Class ActionsAmber
CNIL flagged the need to clarify collective-action ('action collective') conditions during the 2018 law-rewriting ordonnance process.
Claims (1):
- CLM-FR-a10039l5 (claim on file)
Private Right Of ActionAmber
CNIL cannot award compensation; breach victims must pursue police complaints or civil courts for redress.
Claims (1):
- CLM-FR-a10040m6 (claim on file)
Recent Developments 180DGreen
June 2026 G7 DPA meeting in Paris adopted a privacy-preserving age-verification declaration and children's-protection principles; EDPB adopted a common breach-notification template and generative-AI anonymisation/web-scraping and blockchain guidance.
Claims (2):
- CLM-FR-a10041n7 (claim on file)
- CLM-FR-a10042o8 (claim on file)
Enforcement & Redress
France's data protection enforcement activity is characterised by confirmation rather than new sanction. The CNIL closed two separate injunction proceedings by decision of 23 September 2026: one against FRANCE TRAVAIL, closing the order originally issued 22 January 2026 and published 8 October 2026, and one against GOOGLE LLC and GOOGLE IRELAND LIMITED, closing the order originally issued 1 September 2025 and published 14 October 2026. In both instances, the regulator did not proceed to liquidate the penalty payment that had been attached to the original injunction, which is the strongest available signal that the underlying controllers had come into compliance by the time of closure.
The Google-related closure is notable for its connection to a substantially larger enforcement action: the Dutch data protection authority, in cooperation with the CNIL, imposed a fine understood to be in the region of eight hundred and twenty-five million euros on UBER B.V. and UBER TECHNOLOGIES INC. for breaches related to automated decision-making, published 24 August 2026. While that fine falls outside the strict window of the own findings, it is carried forward here as recent context because it illustrates the scale of cross-border cooperative enforcement that French and Dutch authorities are capable of pursuing jointly on matters of overlapping concern, and because the CNIL's injunction closure against Google sits within the same broader automated-decision-making enforcement landscape.
Taken as a pair, the two injunction closures signal an active, functioning enforcement pipeline in France: orders are issued, controllers are given the opportunity to remedy the underlying issue, and the regulator confirms closure once remediation is verified. No new sanction decision dated within the window was identified, and the absence of a new penalty should be read in that light, as a feature of the compliance-confirmation process rather than a gap in enforcement activity.
Outlook
The pattern of injunction closure without penalty liquidation observed in both matters suggests a functioning remediation-and-confirmation enforcement model; continued monitoring of whether other open injunctions in the French pipeline follow a similar closure pattern will help establish whether this is the regulator's consistent practice. The scale of the related Uber fine pursued jointly with the Dutch authority underscores that France's cross-border enforcement cooperation on automated-decision-making matters can produce outcomes of very substantial magnitude, even where the French regulator's own direct action in a given matter, as with the Google closure, resolves without a new penalty.
2 earlier distinct update(s)
Enforcement & Redress
The CNIL's enforcement cadence remained elevated this cycle, anchored by the five-hundred-thousand-euro sanction against HÔPITAL PRIVÉ DE LA LOIRE on 3 September 2026 for security-of-processing failures affecting patients' health data. This sanction, confirmed via the CNIL's own primary sanctions listing, continues a pattern the regulator set with its considerably larger five-million-euro sanction against France Travail earlier in 2026, and sits within a broader run described in independent tracking as approximately twenty-five sanctions totalling roughly thirty-five million euros across 2026 to date. Whatever the precision of that aggregate figure, which derives from secondary commentary rather than a CNIL-published total, the pattern of two substantial, security-focused sanctions within a single year is itself a confirmed, primary-sourced feature of this cycle's enforcement record.
Alongside this substantive sanction, the CNIL closed a procedural matter: by deliberation dated 17 September 2026, the regulator formally closed the cookie-consent injunction it had originally imposed on SOLOCAL MARKETING SERVICES on 15 May 2025. This is a lower-materiality item than the HÔPITAL PRIVÉ DE LA LOIRE sanction, representing the resolution of a prior enforcement matter rather than a new finding of breach, but it is a confirmed, Tier 1-sourced data point in the CNIL's ongoing enforcement docket and indicates the regulator continues to actively manage and close out its injunction caseload rather than leaving matters open indefinitely.
A third item relevant to this domain is procedural and forward-looking rather than a completed enforcement action: the European Data Protection Board's adoption, at its 17 September 2026 plenary, of guidelines on the power to impose administrative fines in relation to other corrective powers under the GDPR, together with finalised guidelines on the interaction between GDPR fines and Digital Services Act fines. This guidance is understood to shape how the CNIL's formation restreinte calculates future fines, though its practical effect cannot yet be assessed since no CNIL decision applying the new methodology had been identified as of this cycle, and the HÔPITAL PRIVÉ DE LA LOIRE sanction itself predates the guideline's 17 September 2026 adoption by two weeks.
Taken together, these three items describe a CNIL enforcement posture this cycle that is simultaneously active on substantive sanctions, methodical about closing out resolved procedural matters, and operating under a fine-calculation framework about to be reshaped by new EDPB guidance whose practical application remains untested.
Outlook
The clearest forward-looking marker for this domain is whether a future CNIL sanction decision visibly applies the EDPB's 17 September 2026 fining-methodology guidelines, which would be the first concrete evidence of how that guidance changes French fine calculation in practice. Separately, given the pattern of two substantial security-of-processing sanctions already recorded in 2026, continued CNIL attention to Article 32 compliance, particularly in sensitive sectors such as health, remains a plausible feature of the enforcement docket through the remainder of the year.
Enforcement & Redress
This cycle's enforcement activity in France is defined by the concurrence of at least three major CNIL fines: €42 million combined against FREE MOBILE and FREE (13 January 2026), €5 million against France Travail (22 January 2026), and €5 million against IQVIA Operations France (26 May 2026). Measured against CNIL's full historical enforcement record of 83 sanctions totalling approximately €486.8 million since GDPR's entry into force, these three 2026 actions together total roughly €52 million within a single reporting period, a concentration that exceeds typical historical annual norms and signals a structurally more aggressive enforcement posture rather than a one-off episodic spike.
CNIL has named information and transparency obligations as its 2026 enforcement-priority theme, mirroring the EDPB's designated focus theme for the year. This forward-looking signal suggests that the three fines already identified this cycle, which concern security measures and DPIA implementation rather than transparency specifically, may be followed by a distinct wave of transparency-focused enforcement action later in 2026, rather than representing the totality of CNIL's enforcement focus for the year.
Outlook
Whether CNIL's transparency-focused enforcement priority materialises into further sanctions in the second half of 2026, and whether the pace of large fines observed in January and May continues, are the two developments most likely to confirm or revise the assessment that CNIL's enforcement posture has structurally intensified.