With computer systems now subject to very regular attacks, the CNIL insists on the need to be prepared in advance for the occurrence of this type of situation by protecting data (encryption, two-factor authentication, etc.) and by providing an appropriate management procedure.<\/p>\n
It is worth remembering that France is one of the countries in the world most affected by security violations, to the point that around fifty senators requested in mid-May the establishment of a parliamentary commission of inquiry on the subject. <\/p>\n
Furthermore, while the CNIL was understanding for a time, it now severely sanctions companies that have not taken timely measures that would have allowed them to block or mitigate attacks.<\/p>\n
![\"French](\"https:\/\/viqtor.eu\/wp-content\/uploads\/2026\/08\/france_1780494638494.jpg\")
<\/p>\n
In France<\/h3>\n
The CNIL published its activity report for the year 2025 in mid-May. <\/strong><\/p>\n The report summarizes a year marked by a sharp increase in complaints and a record number of data breaches<\/strong>half of which are linked to computer hacking.<\/p>\n The authority conducted 323 checks and issued 83 sanctions<\/strong> for an unprecedented total amount of nearly 487 million euros.<\/p>\n Cybersecurity is now a major priority: in 2026, half of the CNIL's checks will focus on data security.<\/p>\n In parallel, the CNIL continues its missions of supporting companies and also strengthens its awareness-raising actions among the general public, particularly young people.<\/p>\n The report also emphasizes the rise of artificial intelligence<\/strong>.<\/p>\n The CNIL is preparing to implement the European regulation on AI and is developing tools to regulate its uses.<\/p>\n However, for 2026, the authority has not obtained any new positions, despite its new skills in this area.<\/p>\n On May 26, the CNIL fined Iqvia Operations France 5 million euros, notably for failing to comply with safeguards aimed at limiting risks to individuals in the context of managing health data warehouses.<\/p>\n On May 11, the CNIL launched an action plan relating to connected glasses. <\/strong><\/p>\n The authority emphasizes that these devices, often associated with AI, can lead to near-constant surveillance in public and private spaces.<\/p>\n A survey shows that 67% of French people see it as a risk to their privacy.<\/p>\n The CNIL (French Data Protection Authority) reiterates that their use remains subject to the GDPR, image rights, and the requirement to obtain the consent of individuals filmed or recorded. It announces a European action plan and recommends several best practices to limit intrusive uses.<\/p>\n This communication comes as Meta develops a facial recognition function for its smart glasses, and as Samsung and Google unveiled on May 19 their first glasses under Android XR, connected to the smartphone and integrated with Gemini, which allow voice interactions and permanent contextual capture.<\/p>\n Finally, at the end of May, the CNIL published a guideline to help cloud actors identify their responsibilities with concrete examples.<\/p>\n The NGO Quadrature du Net<\/strong> published on May 21 an in-depth analysis of the proposed law to ban access to social networks for minors under 15 years of age, the vote on which in Parliament is imminent.<\/p>\n The association points out that, under the guise of protecting minors, the text would impose identity verification on all users, thus generalizing a system previously limited to adult sites.<\/p>\n This obligation would conflict with the GDPR's principle of data minimization and with the right to anonymous browsing recognized by the Court of Justice of the European Union (CJEU).<\/p>\n On May 27, during the presentation of the draft law on child protection, the Minister of National Education, \u00c9douard Geffray, indicated that staff members who had behaved inappropriately with minors at school would now be placed on a "blacklist", even in the absence of a criminal conviction.<\/p>\n The question of procedural safeguards and the protection of the data of the persons concerned remains open.<\/p>\n The third-party payment provider Almerys is once again facing a security breach.<\/strong><\/p>\n On May 24, the Alan health insurance company alerted its members to the data breach that occurred at its subcontractor.<\/p>\n The potentially exposed data includes marital status, social security number, contract number, and coverage dates. Several hundred health insurance companies and millions of social security numbers are believed to be affected.<\/p>\n The incident serves as a reminder that, even in the case of subcontracting, the data controller retains its GDPR obligations regarding security and notification.<\/p>\n In an article published on May 24, 01net reveals the results of an investigation into the workplace monitoring software<\/strong>.<\/p>\n Researchers intercepted network traffic from nine surveillance platforms, all of which transmit employees' personal data to third parties.<\/p>\n The data transmitted includes employee names, email addresses and activity data.<\/p>\n In total, more than 145 third-party domains receive this information, including Google, Meta, Microsoft, LinkedIn, Yandex and AppLovin.<\/p>\n A third of the tools tested also transmit the precise geolocation of the employee.<\/p>\n The European Commission has published a draft set of guidelines clarifying the classification of high-risk AI systems<\/strong>, as well as a list of concrete examples, intended to help suppliers and operators determine whether or not their AI system presents a high risk.<\/p>\n Any interested person or organization, including suppliers and developers, businesses and public authorities, as well as academia, research institutes and citizens, are invited to submit their comments before June 23, 2026.<\/p>\n In early May, Google obtained an extension from the European Commission to address issues related to its compliance with the Digital Markets Regulation (DMA).<\/p>\n In a statement to the European authorities, the company argued that the Commission's proposal to force it, as a "gatekeeper", to share certain search data with competitors such as OpenAI or alternative search engines, presents a significant risk of re-identification of users.<\/p>\n This position might be considered unusual coming from Google, but it is the subject of intense debate these days.<\/p>\n A study published on April 29 in Media Laws establishes a link between this issue of Article 6(11) of the DMA on data sharing and the debates on the Digital Omnibus concerning the scope of the definition of personal data: \u201cSearch Data, Privacy, and the Limits of Heuristics: A Critical Reading of the EC's Preliminary Findings against Alphabet\u201d.<\/p>\n While the proposed regulation on the digital euro<\/strong> As the European Parliament is currently voting on the euro and the Eurosystem is preparing for its issuance by 2029, the CNIL and the German Federal Data Protection Authority published a joint report on May 13 on the data protection challenges of the future digital euro.<\/p>\n The two authorities recall their joint work: the need for a high degree of confidentiality for low-value payments, an "offline" mode without tracking by the ECB and payment service providers, and strict control of authorized purposes (anti-money laundering, fraud prevention).<\/p>\n On May 21, 2026, BEUC, the European Consumer Organisation, together with 29 of its members from 27 countries, filed complaints with the European Commission and the relevant national authorities against Meta, TikTok, and Google, alleging that these companies had failed to take the necessary measures to combat the proliferation of fraudulent advertisements in the financial sector<\/strong> on their platforms, as required by the European Digital Services Regulation (DSA).<\/p>\n The BEUC investigation documents the massive persistence of fraudulent advertisements (quick loans, fake investments, guaranteed returns), of which 53,% reports were allegedly ignored or rejected by the platforms.<\/p>\n The 2026 report from the "GDPR Enforcement Tracker" by the consulting firm CMS shows that the application of the GDPR has entered a phase of maturity in Europe, with more than 3,000 sanctions recorded since 2018 and a total amount exceeding 6 billion euros. <\/strong><\/p>\n National authorities are now targeting not only digital giants, but also everyday operational issues: transparency, cybersecurity, cookies, employee monitoring, and subcontractor management.<\/p>\n The most frequent violations remain the lack of a clear legal basis, non-compliance with the general principles of the GDPR and security breaches.<\/p>\n The digital platform, online advertising and AI-powered services sectors are under particular scrutiny.<\/p>\n The report also highlights that user complaints and data breaches have become major triggers for investigations.<\/p>\n Finally, despite increasing European coordination, sanctioning practices still vary greatly between countries.<\/p>\n The Belgian Data Protection Authority (APD) has fined a technology company a total of \u20ac176,946.61 for illegally keeping a service provider's email account active after they left the company and for breaching transparency obligations.<\/p>\n The authority also ordered the company to comply with the service provider's request for access to provide access logs, then delete personal data and take steps to ensure compliance with regulations in the future.<\/p>\n The APD also announced on May 16 in the daily newspaper Le Soir that it will now take legal action in certain specific cases of serious violations of the GDPR. <\/strong><\/p>\n The authority received 1,394 complaints in 2025, an increase of 67 % compared to 2024.<\/p>\n The criminal route relies on national provisions adopted pursuant to Article 84 of the GDPR, which authorizes Member States to provide for sanctions, including criminal sanctions, for violations not covered by the administrative fines of Article 83.<\/p>\n The explicit objective is to bypass lengthy appeals to the Market Court, which "sometimes reduces severe fines to 1 euro" and the Court of Justice of the EU, which are used by large digital platforms.<\/p>\n The Dutch DPA imposed a MLU BV fined 100 million euros for transferring personal data to Russia. <\/strong><\/p>\n MLU is a Netherlands-based company behind the European version of the Yango taxi app.<\/p>\n In Norway and Finland, users use Yango to book taxi rides with affiliated drivers. Yango then transfers the personal data of drivers and customers to companies located in Russia without guaranteeing adequate protection of this data.<\/p>\n Microsoft reportedly provided the US House of Representatives with the names of Dutch officials working for the Dutch Consumers and Markets Authority and the Dutch Data Protection Authority.<\/strong>These agents would participate in the implementation of the DSA.<\/p>\n According to information published by NL Times, Microsoft allegedly shared emails, reports and invitations without anonymizing the names of the officials involved, as required by the US Cloud Act.<\/p>\n The Dutch State Secretary for the Interior said he was concerned about the situation, while indicating he wanted to clarify the exact circumstances of the transmission.<\/p>\n The Spanish Data Protection Agency (APD) considered that the provision by the Ministry of Education and Sports of cloud-based educational services to public schools, using Microsoft as a subcontractor, constituted a violation of the provisions of the GDPR.<\/p>\n In the United Kingdom, parliamentarians are concerned about the National Health Service's (NHS) decision to grant Palantir access to identifiable patient data.<\/strong> as part of its project to use artificial intelligence "to improve the health system".<\/p>\n The company would gain access to patient data before it was pseudonymized, despite concerns about "the risk of losing public trust".<\/p>\n A parliamentary committee asked the government in early June to terminate the contract with the company.<\/p>\n These concerns are echoed by civil society as well as by NHS analysts who have published an open letter highlighting the risks of the project.<\/p>\n In addition to data protection issues, Palantir's AI system is accused of being ten times slower than the existing system.<\/p>\n In Canada, the Office of the Information and Privacy Commissioner of Ontario publishes New guidelines on AI-based transcription assistants to help protect patient privacy. <\/strong><\/p>\n "The new CPI guidelines align with the Principles for Responsible Use of Artificial Intelligence, recently published and jointly developed by the Information and Privacy Commissioner of Ontario and the Ontario Human Rights Commission.<\/p>\n These principles emphasize that AI systems, such as AI scribes, must be valid and reliable, secure, privacy-respecting, human rights-compliant, transparent, and accountable.<\/p>\n Republican members of the United States House of Representatives have introduced the "SECURE Data Act" and "GUARD Financial Data Act" bills.<\/strong> aiming to establish a federal data protection framework.<\/p>\n These bills aim to harmonize applicable rules by replacing certain state laws, to limit data collection, and to strengthen consumer access rights.<\/p>\n On May 8, 2026, the California Attorney General announced a record $12.75 million settlement with General Motors (GM) to end allegations that GM illegally sold location and driving behavior data of California citizens without proper notification or consent, violating, among other things, the data minimization and purpose limitation principles of the California Consumer Privacy Act (CCPA).<\/p>\n Anthropic announced on May 22nd its Glasswing project, stating that its cybersecurity-specialized AI model, Mythos, has identified more than 10,000 vulnerabilities in widely used open source software and projects. <\/strong><\/p>\n According to the company, AI significantly improves the speed and efficiency of vulnerability research, with a detection rate considered high.<\/p>\n However, this capability creates a new challenge for the software ecosystem: maintainers and security teams must deal with an increasing volume of reports and fix vulnerabilities faster.<\/p>\n Beyond the technical feat, the subject highlights the evolution of cybersecurity towards increased automation of vulnerability detection, with their rapid correction remaining the main factor in risk reduction.<\/p>","protected":false},"excerpt":{"rendered":" Nous l\u2019\u00e9voquions dans une r\u00e9cente actualit\u00e9, le sous-traitant est \u00e0 la fois un acteur central et incontournable pour de nombreux responsables de traitement, et un maillon faible dans la cha\u00eene de s\u00e9curit\u00e9 des donn\u00e9es. La jurisprudence r\u00e9cente, tout comme les d\u00e9cisions des autorit\u00e9s de protection des donn\u00e9es, ont rappel\u00e9 que le responsable de traitement reste […]<\/p>","protected":false},"author":1,"featured_media":14506,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[35],"tags":[],"class_list":["post-14510","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-veille-juridique"],"acf":[],"yoast_head":"\n![\"European](\"https:\/\/viqtor.eu\/wp-content\/uploads\/2026\/08\/Europe_1780494688401.jpg\")
<\/p>\nIn Europe<\/h3>\n
European institutions and bodies<\/h4>\n
News from the member countries of the European Union.<\/h4>\n
![\"Flags](\"https:\/\/viqtor.eu\/wp-content\/uploads\/2026\/08\/INTERNATIO_1780494763286.jpg\")
<\/p>\nInternationally<\/h3>\n