法国CNIL就数据泄露对NEXPUBLICA FRANCE罚款170万欧元

Summary of the DecisionOrigin of the caseNEXPUBLICA FRANCE has developed a user relationship management software named PCRM which is used in the field of social action, in particular by departmental houses for the disabled (MDPH). In November 2022, the CNIL was notified of a data breach by NEXPUBLICA FRANCE customers for being able to access documents concerning third parties. The CNIL then carried out investigations which revealed insufficient technical and organizational measures to secure personal data of the PCRM software.Key FindingsBreach of the obligation to secure personal data (Article 32 of the GDPR)NEXPUBLICA FRANCE did not comply with the requirements provided for by the article 32 of the GDPR for the implementation of its PCRM, given the widespread weakness of the information system and the negligence it showed in allowing structural security problems to persist.DecisionOn the basis of these investigations, the restricted committee – the CNIL body responsible for imposing sanctions – considered that the company had failed to comply with the article 32 of the GDPR.The restricted committee therefore issued a fine of €1.7 million and decided to make its decision public. This decision took into account the company’s financial capacity, its failure to comply with basic security principles, the number of people affected and the sensitivity of the data processed (in particular, revealing a disability).For further information:[FR]: https://www.cnil.fr/fr/securite-des-donnees-sanction-de-1-700-000-euros-lencontre-de-la-societe-nexpublica-france[EN]: https://www.cnil.fr/en/data-security-nexpublica-france-fined-eur1700000