The 60-second summary
On 8 October 2026, CNIL published the closure of its security injunction against France Travail. The decision is dated 23 September 2026. Evidence demonstrated compliance with ordered password/access restrictions, MFA, active activity-log supervision and limited adviser access. CNIL declined to collect the conditional €5,000-per-day penalty. The original €5 million fine was a separate January decision; this closure does not cancel it or certify all processing. The operational lesson is to make remedial controls testable and retain evidence against each ordered requirement.
Timeline that matters
22 January 2026
25 February and 31 March 2026
23 September 2026
8 October 2026
10 November 2026
What changed
The newly published decision closes the January security injunction after timely evidence of compliance.The decision describes password lockout changes, MFA, alerting and narrower data-access permissions.The contingent daily penalty was not collected; the closure is distinct from the original fine.
Who should care
Security and identity teams managing remedial actionsPrivacy officers and incident-response leadersPublic-service and high-volume data platform operatorsInternal audit, assurance and regulatory-response specialists
Why this matters for global organisations.
Remediation programmes need an evidence trail linking each requirement to a deployed control, a test result and an accountable owner. Authentication, monitoring and access restrictions should be checked together to reduce the impact of a compromised account.
13 actions to start now
- Break each remedial requirement into an owner, deliverable, evidence item and due date.
- Separate regulatory commitments from additional internal improvement targets.
- Baseline identity settings before making changes and retain versioned configurations.
- Test password lockout and recovery paths without exposing real credentials.
- Verify MFA coverage for all accounts in scope, including privileged and external users.
- Identify access paths that bypass the intended authentication controls.
- Map sensitive fields to job functions and approve access on that basis.
- Test denied access and remove permissions that are unnecessary for the task.
- Confirm activity logs reach the monitoring team with usable timestamps.
- Exercise alert thresholds and document how responders investigate anomalous activity.
- Compare controls promised in risk assessments with what is deployed in production.
- Package dated evidence against each commitment and protect evidence containing personal data.
- Record the closure outcome precisely and continue scheduled assurance after the order closes.
Evidence worth retaining
- Requirement-to-control register and accountable owners
- Dated identity configurations and authentication coverage
- Positive and negative access tests
- Alert tests, triage records and logging coverage
- Risk-assessment actions linked to production evidence
- Submitted evidence, correspondence and closure decision
Questions to take to counsel or your conformity team
These are discussion prompts, not legal advice or conclusions.
- Which requirements are covered by this specific closure, and which remain outside it?
- Do our own orders distinguish implementation from delivery of supporting evidence?
- How should we document access restrictions for shared-service users?
- Are any appeal, fine-payment or other proceedings separate from remediation closure?
Official sources
- CNIL closure announcement, 8 October 2026
- Closure decision SAN-2026-013, 23 September 2026; published 8 October 2026
- CNIL original sanction announcement, 29 January 2026
PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.
PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.