Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

CNIL Fines NEXPUBLICA FRANCE EUR 1.7 Million for Insufficient Data Security Measures Leading to Breach

The CNIL on 22 December 2025 fined NEXPUBLICA FRANCE EUR 1.7 million for insufficient data security measures that led to a data breach. This decision holds the company accountable for widespread weaknesses in its information system and negligence in allowing structural security problems to persist.

The French data protection authority, the CNIL, imposed an administrative fine of EUR 1.7 million on NEXPUBLICA FRANCE following investigations into a data breach. The breach, notified in November 2022 by customers, allowed access to third party documents through the company's PCRM software, which is used in social action, particularly by departmental houses for the disabled (MDPH). The CNIL's restricted committee found that NEXPUBLICA FRANCE did not comply with the requirements of Article 32 of the GDPR, citing pervasive weaknesses in the information system and negligence in addressing persistent security issues. The decision to make the fine public also considered the company's financial capacity, its failure to adhere to basic security principles, the number of individuals affected, and the sensitivity of the processed data, which included information revealing disabilities.

Data security failures remain a persistent challenge, with Article 32 of the GDPR frequently cited in enforcement actions.

Article 32 GDPR

Who this binds
Organisations processing personal data, particularly those developing and implementing software for sensitive sectors like social action, must ensure robust data security.
What changed
The CNIL's decision on 22 December 2025 clarifies that pervasive information system weaknesses and negligence in addressing structural security problems constitute a breach of Article 32 GDPR.
What to check
Organisations should review their technical and organisational measures for data security, especially for software handling sensitive data, against the requirements of Article 32 GDPR.
What this does not mean
This decision does not mean that all data breaches automatically result in a EUR 1.7 million fine, as the amount was determined by specific factors including financial capacity and data sensitivity.

Send this to your team

The CNIL fined NEXPUBLICA FRANCE EUR 1.7 million on 22 December 2025 for failing to implement sufficient data security measures under Article 32 GDPR, affecting organisations that process sensitive personal data.

Today's question

A telecommunications company in France experiences a data breach where an attacker gains access to 24 million subscriber contracts, including IBANs. The CNIL investigates and finds insufficient security measures and delayed notification to data subjects. Which GDPR articles are most likely to be cited in the resulting enforcement action?

  1. Article 5(1)(a) (Lawfulness, fairness and transparency) and Article 6 (Lawfulness of processing)
  2. Article 32 (Security of processing) and Article 34 (Communication of a personal data breach to the data subject)
  3. Article 17 (Right to erasure) and Article 21 (Right to object)
  4. Article 28 (Processor) and Article 30 (Records of processing activities)

Answer this question on the site

Worth knowing

  1. ICO Conducts Data Protection Audit of Scottish Courts and Tribunals Service

    Public sector bodies, particularly within the criminal justice system, should anticipate and prepare for data protection audits from the ICO to ensure ongoing compliance with UK GDPR.

  2. Dutch DPA Advises Twitch Users to Opt Out of Data Sharing with Amazon AI

    The Dutch Data Protection Authority's advice to Twitch users to disable Amazon AI data sharing signals increasing regulatory scrutiny on how streaming platforms use user generated content for artificial intelligence model training.

  3. Connecticut says data from 41,000 Medicaid members exposed in portal breach; the second portal incident this year

    The repeated portal breaches affecting Connecticut Medicaid members signal that public sector organisations managing health data may face systemic vulnerabilities requiring enhanced vendor oversight.

  4. Notes from the IAPP Canada: When deleting data too soon becomes the privacy risk

    Privacy professionals in Canada must understand that data minimisation involves careful data retention policies, where premature deletion can itself create privacy risks, as noted by the Newfoundland and Labrador Commissioner.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.