Overview of Sanctions Issued by the CNIL in 2024

Key Takeaways

In its 2024 annual report, the CNIL highlights a significant increase in sanctions and other corrective measures imposed for non-compliance with the GDPR.

Each year, the CNIL publishes a report on its activities for the previous year. On February 5, 2025, the Commission released its overview of sanctions and corrective measures issued in 2024. (1) These have seen a sharp increase compared to the previous year.

1. A Sharp Increase in Sanctions and Corrective Measures

The CNIL's enforcement actions against organizations (i.e. businesses, public administrations, associations) that fail to comply with the GDPR include, on one hand, sanctions often accompanied by fines, and on the other hand, formal notices and legal warnings.

In 2024, the CNIL issued 331 corrective measures, including:

     - 87 sanctions, totaling €55,212,400 in fines (including a €50 million fine against ORANGE, imposed in November 2024).

A total of 69 sanctions were issued under the simplified procedure, amounting to €715,000 in fines. The simplified procedure is a new enforcement mechanism introduced in 2022.

     - 180 formal notices and 64 legal warnings were issued. In most cases, organizations comply with these measures following their issuance.

Most sanctions and formal notices issued by the CNIL are not publicly disclosed. Only a limited number of sanctions are made public.

2. Key GDPR Violations Leading to Sanctions

The CNIL has also identified the main areas where organizations have failed to comply with the GDPR, including:

     - Consent collection requirements in commercial prospecting. Companies using databases for marketing purposes (advertisers, data brokers, email marketing companies, etc.) must ensure that the original data collectors (2) have properly obtained opt-in consent from individuals to receive promotional messages, in accordance with GDPR requirements.

     - Pseudonymization is not the same as anonymization. Several rulings were issued against organizations storing health data. Although these organizations did not have direct access to the identities of the data subjects, the data was stored under pseudonyms. While anonymized data is permanently non-identifiable (and therefore no longer subject to the GDPR), pseudonymized data (linked to an identifier) poses a risk of re-identification and remains subject to the GDPR.

     - Failure to comply with individuals' rights was sanctioned 23 times, as organizations failed to honor requests for access to personal data (i.e. data stored in their user account or file), objection to data processing, or data deletion requests. Sanctions were also imposed on organizations that used complex mechanisms for cookie refusal.

     - Violation of the data minimization principle. The principle of minimization requires that personal data collected must be relevant and limited to what is necessary for the purposes for which it is processed. Ten sanctions were issued for excessive data collection, including unjustified commentary, the systematic or full recording of phone conversations, and the continuous video surveillance of employees at their workstations.

     - Multiple violations of data security obligations were identified, such as weak passwords or storing them in plain text, the absence of an access authorization policy, inadequate access controls for electronic health records (EHRs) by healthcare professionals, and the use of outdated TLS encryption protocols.

     - Finally, 27 organizations were sanctioned for failing to cooperate with the CNIL following requests for information or during compliance audit procedures.

(1) "Sanctions and Corrective Measures: CNIL's 2024 Enforcement Report” (in French), February 5, 2025

(2) A "primary data collector" is an organization that collects data directly from data subjects. This  may be a company organizing sweepstakes or an e-commerce website, for example.

Bénédicte DELEPORTE
Avocat

Deleporte Wentz Avocat
www.dwavocat.com

February 2025