France’s public employment agency, France Travail, was fined 5 million euros by the CNIL for a March 2024 data breach that exposed the personal data of about 36.8 million people registered with the agency over the past two decades.

France Travail acknowledged the severity of the breach, did not contest the decision, and said it had already implemented corrective measures, including two-factor authentication for almost two years.

CNIL said existing safeguards did not sufficiently reduce the risk of unauthorized access from compromised accounts.

The penalties are part of a broader push to strengthen data protection and security practices across French public and private entities.

The exposed data included social security numbers, email and postal addresses, and phone numbers.

The CNIL decision was issued on January 22 and confirmed in a restricted-formation deliberation, with ongoing questions about the adequacy of France Travail’s data protection and security measures.

The fine is tied to violations of GDPR Article 32, which requires appropriate security measures proportional to processing risks.

attackers used social engineering to access accounts of Cap Emploi counselors who connect to France Travail databases through a partner, highlighting awareness gaps and the scale of the data involved.

The breach arose after attackers targeted Cap Emploi adviser accounts via social engineering, exploiting authentication weaknesses.

CNIL’s enforcement comes alongside other penalties for major entities, underscoring active GDPR enforcement signals in France.

Initial disclosures suggested up to 43 million could be affected, but deduped figures put the total at 36.8 million.

CNIL imposed a daily fine of 5,000 euros for delays in implementing access restrictions for Cap Emploi counselors, with a one-month grace period following the January 22 notice.