France’s CNIL fines France Travail €5 million over jobseeker data security failures

France’s data protection authority (CNIL) recently informed the public that it had fined France Travail, a local employment platform, €5 million after finding the organization did not adequately protect jobseekers’ personal data. The CNIL’s decision followed a 2024 security incident that the company reported to authorities. Following an investigation, it was determined that the company did not use the expected authentication mechanisms required to protect users’ data. 

Businesses must keep in mind that if access controls and account protections are not strong enough to withstand realistic phishing and social engineering attempts, organizations may be found at fault. The expectation is that systems holding broad population-level datasets should have mature, tested security measures, given the wide potential impact.

‍