Skip to content

CNIL

CNIL is France's independent data protection authority, enforcing privacy law and overseeing how organizations handle personal data.

Known aliases

  • Commission nationale de l'informatique et des libertés
  • French data protection authority
  • French data protection regulator

Current stories

securityConfirmed6 publishers

DGFiP breach started with a borrowed identity, not a bug

France's tax authority says an intruder used a stolen or misused identity to reach its systems in late June and extract data on individuals and businesses before access was cut.

Perspective Coverage

6 publishers
Builder
Builder 28%
Operator
Operator 62%
Investor
Investor 10%

Reality

Evidence72
Adoption
Not scored
Hype gap+10
Incentives60
Confidence68
productOne report1 publisher

Paris prosecutors open a criminal inquiry into women filmed by camera glasses

France's data regulator has fewer than 10 workplace complaints about smart glasses on file and says a recording light is not adequate notice on its own. Companies are already asking it whether they can ban the glasses at the door.

Publishers:thenextweb.com

Reality

Evidence52
Adoption61
Hype gap+18
Incentives58
Confidence47
buildOne report1 publisher

Companies are asking France's CNIL whether they can bar smart glasses from their premises

Paris prosecutors have opened at least one criminal case over street videos of women filmed without consent. The data regulator has fewer than ten workplace complaints on file and a growing queue of employers asking about bans.

Publishers:mezha.net

Reality

Evidence45
Adoption55
Hype gap+10
Incentives60
Confidence50
securityOne report1 publisher

CNIL puts €500,000 on the control gaps behind a 727,113-record hospital breach

Hôpital privé de la Loire lost records on 727,113 people over several days in the summer of 2025. CNIL's decision names each control that was missing. It prices the whole set at about 69 cents a record.

Reality

Evidence64
Adoption34
Hype gap−12
Incentives55
Confidence61
securityOne report1 publisher

SFR's leak came out of a fibre provisioning tool, not the customer portal

The operator says an internal tool for managing and analysing fibre connections was accessed without authorisation. The forum post claiming the data counts 2,104,093 rows.

Publishers:frenchbreaches.com

Reality

Evidence58
Adoption55
Hype gap+12
Incentives66
Confidence60
productOne report1 publisher

France's tax agency lost 678,000 records through logins it had issued itself

DGFiP says the intruder used a stolen employee identifier and an authorised third party's credentials, and claimed to bypass MFA. No zero-day was involved.

Publishers:thenextweb.com

Reality

Evidence63
Adoption71
Hype gap+12
Incentives74
Confidence58
productOne report1 publisher

France's under-15 ban failed on the age check, not the age limit

The Constitutional Council struck Article 1 two weeks before enforcement, and one of its two grounds was that the law offered no privacy guarantees for age verification.

Publishers:thenextweb.com

Reality

Evidence55
Adoption8
Hype gap+14
Incentives62
Confidence48