Over €55 million in fines and a surge in compliance actions

2024 marked a year of intensified enforcement by the French data protection authority (CNIL), with a focus on ensuring compliance across various sectors and reinforcing individuals' data protection rights.

CNIL issued a total of 331 measures last year, including fines totalling €55,212,400 as well as 180 enforcement notices (a 267% increase from 2020) and 64 warnings. 

The sanctions covered various areas, such as:

• Direct marketing: non-compliance with the opt-in consent requirement; 
• Mailbox services: mailbox provider’s non-compliance with the opt-in consent obligation in the context of advertisements inserted into users' email inboxes, between emails; or
• Health data warehouse:  non-compliance with the obligation to apply for a CNIL authorisation, where the data held in the warehouse was determined to be pseudonymised and not anonymised. 

In addition, CNIL's simplified sanction procedure, introduced in 2022, resulted in 69 sanctions, primarily for lack of cooperation, failure to respect data subjects’ rights, non-compliance with the data minimisation principle, and insufficient data security measures. 

CNIL’s priorities over the next three years 

Looking ahead, CNIL has outlined its priorities for 2025-2028, which include:

1. Promoting ethical and rights-respecting AI 

• Share knowledge and expertise within the AI ecosystem.
• Clarify the legal framework, ensuring alignment between the AI Act and GDPR, and support innovative projects with privacy-enhancing technologies.
• Educating the public. 
• Develop methodologies to audit AI systems.

2. Protecting minors 

• Increase CNIL's presence on the ground to educate children, parents, and educators about data protection.
• Empowering minors to exercise their data rights. 
• Promoting responsible digital usage.
• Strengthen oversight of online platforms targeting minors.

3. Making everyone a cybersecurity actor to build trust in the digital space

• Collaborating with the cybersecurity ecosystem to harmonize the application of EU regulations (e.g., NIS2, DORA) and integrating data protection into security standards.
• Capacity building to prevent and respond to data breaches, fostering a culture of security.
• Supporting the development of privacy-enhancing technologies. 
• Increasing enforcement actions. 

4. Implementing targeted actions on everyday digital practices

• Promoting compliance among mobile app developers.
• Promoting the development of compliant digital identity systems, collaborating with EU regulators on eIDAS and the European Digital Identity Wallet.

CNIL has been able to intensify its enforcement actions by increasing its headcount and, more importantly, by leveraging its fast-track sanction procedure. Unsurprisingly, AI is at the top of CNIL's priorities over the next three years and CNIL is committed to maintaining a strong influence on both the ecosystem and regulatory developments.