What happened
The French data protection authority (CNIL) closed the injunction issued on 22 January 2026 against FRANCE TRAVAIL, after the organization demonstrated compliance with the security measures required by Article 32 of the GDPR. The original sanction included a €5 million fine and a daily astreinte of €5 000 for non‑compliance, which was not liquidated. FRANCE TRAVAIL implemented a stronger password policy, multi‑factor authentication, active log monitoring and limited data access for CAP EMPLOI advisors.
Why it matters for trust and compliance
- Its status is decided. The case has an outcome that others may cite.
- The closure shows that timely remediation of GDPR security deficiencies can halt additional penalties.
Who is affected
government controller FRANCE TRAVAIL
Recommended actions
- Confirm access, correction, deletion and opt-out requests are handled within the required time.
- Revisit retention schedules and data minimisation for the data involved.
- Map the security requirements to existing controls and close gaps.