France Travail fined €5 million for inadequate data security

Original title: Data breach: France Travail fined €5 million

France Travail, a French public employment service, was fined €5 million by CNIL for inadequate technical and organisational security measures that failed to prevent a 2024 data breach. Hackers exploited weak authentication procedures and overly broad access permissions to compromise personal data of individuals registered with the service over 20 years, including National Insurance numbers, emails, and contact information. The fine reflects France Travail's failure to implement security measures that had been identified in prior impact assessments, alongside ordered corrective measures with a €5,000 daily penalty for delays.

What changed

• France Travail was fined €5 million by CNIL's restricted committee for violating Article 32 of the GDPR (Security of processing) due to inadequate implementation of technical and organisational security measures that should have prevented or hindered the 2024 data breach.
• The investigation revealed specific security failures: insufficient authentication procedures for CAP EMPLOI advisers, inadequate logging measures to detect abnormal system behaviour, and overly broad access authorisations that allowed staff to access data beyond their operational scope.
• CNIL determined that France Travail had identified appropriate security measures in prior impact assessments but failed to actually implement them before processing began.
• In addition to the fine, France Travail was ordered to justify all corrective measures taken with a precise implementation schedule, with a penalty of €5,000 per day of delay for non-compliance.
• The breach affected personal data of all individuals registered or previously registered with France Travail over the past 20 years, as well as candidate account holders, compromising National Insurance numbers, emails, postal addresses, and telephone numbers.

Who is affected

France Travail (French public employment service); organisations supporting employment of people with disabilities; individuals registered with the service over 20 years and candidate account holders on francetravail.fr.