NEXTPUBLICA France – €1,700,000 Fine (France, 2025)

Nextpublica, a software consulting company (the processor) provided the Maison Départementale pour les Personnes Handicapées MDPH, a public interest group (the controller), with software for processing files relating to persons with disabilities. This software enabled users (data subjects) to upload their files and track their progress via an online portal. On 2 November and 10 November 2022, data subjects using the portal reported to the controller that they had access to files relating to other data subjects. On 22 November 2022, the controller notified the data breach to the DPA. The breach was found to be due to a configuration mistake, made by the processor. After an on-site inspection, the DPA opened an investigation. The dispute related to the processor’s responsibility for implementing adequate security measures, under Article 32 GDPR. On the fairness of the procedure: At first, the DPA rejected the argument based on a violation of Article 6 ECHR. The DPA pointed out that the right not to incriminate oneself is not incompatible with the sharing of the complainant’s internal reports, even under coercive measures. What’s more, the disclosed reports are evidence on which the DPA can base its argument. About responsibilities: The DPA jointly appreciated article 4(8) GDPR, article 28 (3)(a) GDPR and article 32 GDPR. The DPA noted that the contract binding the processor and the controller, as well as the processor’s expertise as a software consulting company, show that the processor was responsible for ensuring data security. As a result, the processor was also responsible for its sub-processors compliance to GDPR, especially when they introduced a block of computer code on the software’s code. On the violation of article 32 GDPR: The DPA recalled that the definition of security measures must take into account the state of art, the cost of such measures, but also the risks of the processing and the category of personal data processed. The rapporteur noted that the personal data processed were sensitive data, and that the security measures must be adapted to such circumstances. To evaluate the measures taken, the DPA referred to a principle of the National Agency for Information Systems Security (French [https://cyber.gouv.fr ANSSI]). The principle is that the security of an information system must be based on a coherent whole, rather than on specific security points, so that, in theory, the whole does not depend on a few security points. With this principle, the information system is supposed to balance the failure of one of its security points. Here, the DPA highlighted that the software was processing a large amount of personal data, even sensitive data, with a high risk for data subjects in case of a violation, due to the aggregation of extremely precise and various data (health related, national identifier, financial status, identification data). The processor was aware of critical and significant vulnerabilities, thanks to reports he commissioned. In addition, an internal report had identified the weakness of the information system security, particularly the use of an obsolete encryption system. However, the processor has not taken any measures to remedy the situation before a breach occurred. The DPA considered that the processor had not taken sufficient measures to ensure the security of the personal data processed, and so violated article 32 GDPR. A fine of €1,700,000 is imposed to the processor.