CNIL Fines NEXPUBLICA FRANCE €1.7 Million for GDPR Security Failures

CNIL fined Nexpublica France €1.7 million following a November 2022 incident where users of the company’s PCRM portal could access third-party documents containing highly sensitive personal data (including disability information). The regulator found long-standing technical and organisational deficiencies, identified prior audit findings that were not remediated before the breach, determined a violation of Article 32 of the GDPR, and imposed the penalty while noting corrective measures were implemented only after the exposure was reported.