FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
Criminal penalties include fines up to EUR300,000; imprisonment for up to five years; and publication of conviction decisions. However, criminal prosecution is very rare in practice. The CNIL refers cases to pros - ecuting authorities where criminal elements appear evident, but prosecutors exercise prosecutorial dis - cretion in pursuing charges. Aspects Used to Set Penalty Levels The CNIL applies the criteria set out in Article 83 (2) of the GDPR to determine the amount of the fine, includ - ing the seriousness and impact of the infringement, whether the conduct was intentional or negligent, and the controller’s efforts to mitigate damage. It also con - siders elements such as prior violations, the degree of co-operation with the authority, and the sensitivity of the personal data concerned. It is important to note that the CNIL does not provide details on how it reaches a specific amount, including when that amount covers infringements of different natures. The absence of any obligation in this respect was confirmed by the French Supreme Administrative Court (Conseil d’État). 1.9 Enforcement Trends Over the last approximately 24 months, data-protec - tion enforcement in France has become both higher volume and higher impact. In 2024, the national regu - lator reported 331 corrective measures, including 87 financial penalties totalling EUR55,212,400, alongside a record 17,772 complaints. It also received 5,629 personal-data breach notifications (20% more than in 2023) and highlighted a rise in very large-scale inci - dents, noting that breaches affecting more than one million individuals doubled. In 2025, it issued 83 sanc - tions with cumulative fines of EUR486,839,500 and identified three recurring enforcement themes: cook - ies/trackers, employee monitoring, and data security. Most significant enforcement trends: • Cookies and trackers are driving the biggest expo - sure: there have been repeat findings to do with placing trackers without valid prior consent or pro - viding sufficient user information, as well as failure to respect refusals or withdrawals of consent.
• Workplace surveillance under sustained scru - tiny: enforcement emphasised that continuous or disproportionate employee monitoring, nota - bly through video surveillance, is unlawful in the absence of exceptional, well-justified circumstanc - es. • Processor compliance in the spotlight: sanctions also addressed breaches of processors’ obliga - tions, recalling in particular the need to – (a) implement appropriate technical and organisa - tional security measures; (b) process data only on the controller’s docu - mented instructions; and (c) delete data at the end of the contractual rela - tionship. • Security of processing as a major enforcement driver: the regulator issued particularly heavy sanctions in 2025 for shortcomings in the security of processing, repeatedly underscoring the need to apply strict “baseline hygiene” measures (eg, strong authentication and access control, timely patching, secure configuration, least privilege, and monitoring). • More frequent enforcement via streamlined pro - cedures: the regulator attributes a sharp rise in the number of sanction decisions to its simplified process, increasing the likelihood of action against a broader set of organisations. Over the last 24 months, personal data disputes in France have increasingly reached the courts through private enforcement of the GDPR. Two recurring streams stand out: (i) compensation claims following security incidents or unauthorised disclosures; and (ii) litigation seeking compliance with data-subject rights – particularly access requests, including in an employ - ment context (eg, access to professional emails, sub - ject to the rights of others). Claimants are mainly individuals (customers, users, employees or former employees). Typical remedies include compliance orders (eg, to grant access, erase 2. Privacy Litigation 2.1 Privacy Litigation Overview General Trends
120 CHAMBERS.COM
Powered by FlippingBook