Closure of the order issued against FRANCE TRAVAIL

Background information

In January 2026, the restricted committee – the CNIL body responsible for issuing sanctions – imposed a fine of €5 million against FRANCE TRAVAIL due to the inadequacy of the measures implemented to ensure the security of job seekers' data.

In addition of the fine, the restricted committee had issued orders to ensure the implementation of security measures in accordance with Article 32 of the GDPR, and more specifically:

• regarding password strength, implement a password policy that includes mechanisms to restrict access to accounts;
• regarding the authentication procedures for CAP EMPLOI advisors' user accounts, implement multi-factor authentication;
• regarding the monitoring the MAP tool's activity logs, provide for active monitoring of the information system and activity logs;
• regarding the management of access permissions for personal data, restrict access by CAP EMPLOI advisors to only the data necessary for them to carry out their support duties.

Failure to comply with these orders exposed FRANCE TRAVAIL to the payment of a penalty (i.e. an additional fine) of €5,000 per day of delay.

Closure of the order

In response to this order, FRANCE TRAVAIL demonstrated, within the specified time frame, that it had complied with all the orders issued to it to ensure the security of the personal data being processed. FRANCE TRAVAIL implemented greater security for authenticating CAP EMPLOI advisor accounts, including a new, more robust password policy, as well as multi-factor authentication for accessing these accounts. FRANCE TRAVAIL also implemented additional measures in its activity log analysis and monitoring system, as well as restrictions on the data to which CAP EMPLOI advisors can access in connection with their duties.

In view of this compliance, the restricted committee decided not to liquidate the penalty payment (i.e. not to require payment of the additional fine referred to above) and to close the order.