This LAVOIX newsletter presents a selection of news items from July to September 2026 in the field of data protection.
1. CNIL decisions
Failure to comply with the right to erasure: a fine of €300,000 imposed on EXTIA
In a decision dated 21 July 2026, the CNIL imposed a €300,000 fine on EXTIA for several breaches relating to the exercise of the right to erasure. In particular, the authority noted that, in many cases, the data subjects had not been provided with appropriate information regarding the processing of their requests.
The CNIL reiterates that the data controller remains obliged to inform data subjects of the action taken in response to their requests and to comply with the obligations set out in Articles 12 and 17 of the GDPR. This decision highlights the importance of documenting internal procedures for managing data subjects’ rights and of maintaining a record of the responses provided to requesters.
Health data: €500,000 fine for failure to implement security measures
In a decision dated 21 July 2026, the CNIL imposed a €500,000 fine on the Hôpital Privé de la Loire following a data breach affecting more than 524,867 patient records.
The authority noted the absence of several basic security measures, particularly regarding authentication and the detection of unauthorized access. It reiterates that organizations processing health data must implement technical and organizational measures proportionate to the risks involved in order to ensure a level of security appropriate to the risks, in accordance with Article 32 of the GDPR.
This decision highlights the particular attention paid by the CNIL to the security of systems containing sensitive data.
Automated decisions: €825 million fine imposed on Uber
The Dutch authority, in collaboration with the CNIL, has imposed a fine of €825 million on Uber for data processing involving automated decision-making processes affecting the platform’s drivers.
In particular, the authority criticizes the lack of sufficient safeguards surrounding certain decisions with significant consequences for data subjects, as well as a failure to ensure effective human intervention.
This decision highlights the importance, for organizations using automated decision-making tools, of documenting the mechanisms for human oversight and the means of challenge available to data subjects.
2. CNIL documentation
Electronic invoice: the CNIL reiterates the requirements regarding personal data
In light of the gradual roll-out of electronic invoicing the CNIL published a document on 10 September 2026 setting out the main data protection issues associated with this reform.
In particular, the authority reiterates the applicable rules regarding the responsibilities of the various parties involved, data retention periods, data processing security and the provision of information to data subjects.
Companies involved in implementing electronic invoicing would therefore be well advised to ensure their processes comply with the requirements of the GDPR from the very start of the roll-out phase.
DPO: the CNIL clarifies measures to prevent conflicts of interest
In a recommendation published on 10 August 2026, the CNIL sets out the conditions under which additional duties may be entrusted to a Data Protection Officer.
The authority emphasizes the need to identify in advance situations likely to give rise to a conflict of interest, particularly where the DPO is involved in determining the purposes or means of processing.
The CNIL recommends documenting this analysis and reviewing it regularly in order to safeguard the DPO’s independence.
Tracking pixels: the CNIL publishes an FAQ for professionals
Following its recommendation published in April 2026 on tracking pixels in emails, the CNIL published a webinar and an FAQ online over the summer, aimed at email marketing solution providers and their clients.
Organizations using email open-rate tracking tools would be well advised to check that their practices comply with the CNIL’s recommendation and the requirements regarding the collection of consent.
The CNIL and the CNIAM have highlighted the data protection challenges posed by the development of agentic AI.
In a guidance note published on 20 July 2026, the CNIL and the Council for AI and Digital Technology (CIANum) analyze the challenges raised by the development of agentic AI systems, that are systems capable of autonomously performing certain tasks whilst interacting with their environment.
The guidance note emphasizes that the increasing autonomy of these systems may lead to more complex processing of personal data, particularly in terms of data collection, data reuse, human supervision and the allocation of responsibilities.
The authors therefore urge organizations to take these issues into account right from the design stage of their tools in order to ensure compliance with the principles of the GDPR and appropriate governance of the processing operations carried out.
3. Legal and case law news – France
Request for erasure: Court of cassation quashes decision due to failure to disclose the Attorney General’s submissions
In a judgment of 8 September 2026, the Court of Cassation quashed an order dismissing a request for the erasure of data contained in a criminal records file.
It noted that the Attorney General’s submissions had not been communicated to the applicant before the appeal was considered. It held that such a situation contravenes the principle of adversarial proceedings and the rights of the defense.
This decision serves as a reminder that procedures relating to the erasure of data contained in police records must comply with procedural safeguards enabling the data subjects to effectively put forward their views (Court of Cassation, 8 September 2026, appeal no. 25-87.632).
The Council of State reiterates the concept of the ‘data subject’
In a decision of 27 August 2026, the Council of State confirmed that a complaint lodged on the basis of Article 77 of the GDPR may only be brought by a data subject to whom the data in question relates.
A liberal doctor challenged the CNIL’s refusal to take action against a service provider holding his patients’ data. The Council of State ruled that this mechanism was not intended to allow a data controller to defend its own interests, nor for the data controller to act in place of the data subjects.
The decision thus serves as a reminder of the limits of the remedies available under the GDPR before supervisory authorities.
Reminder of the conditions for challenging CNIL decisions before the administrative court
In a decision of 27 August 2026, the Council of State dismissed the appeal brought by the Dataring association against the CNIL’s refusal to revoke its decision of 21 December 2023 authorizing the Health Data Platform to implement the ‘EMC²’ health data warehouse.
The Council of State notes that this authorization constitutes an individual rights-conferring decision. Pursuant to Article L. 242-1 of the Code of Relations between the Public and the Administration, such a decision may only be withdrawn or revoked if it is unlawful and within four months of its adoption. As the request for repeal was submitted more than a year after the initial decision, the CNIL was justified in rejecting it.
This decision serves as a reminder that individual authorizations issued by the CNIL received a certain degree of legal stability once the four-month period provided for by the CRPA has expired (Council of State, 10th Chamber, 27 August 2026, No. 505676).
4. Legal and case law news – Europe and International
Freedom of expression: the CJEU clarifies the journalistic exemption under the GDPR
In the Legal Newsdesk Sweden case, the CJEU was asked to rule on whether the publication of criminal convictions could benefit from the exception applicable to processing carried out for journalistic purposes, pursuant to Article 85 of the GDPR.
The Court reiterates that the mere provision of court decisions for a fee is not sufficient to constitute a journalistic purpose. This must be accompanied by editorial work serving the objective of informing the public. In the absence of such safeguards, the processing operations remain subject to the requirements of the GDPR.
This decision confirms that the exemptions provided for in respect of freedom of expression must be interpreted strictly and that data controllers must be able to provide concrete evidence of the journalistic purpose invoked (CJEU, 9 July 2026, C-199/24 – Legal Newsdesk Sweden AB).
Reminder of the method for assessing the lawfulness of data processing (Article 6(1)(f) of the GDPR)
In the RRC Sports case, the CJEU reiterates the three cumulative conditions required to justify processing on the basis of a legitimate interest: the existence of a legitimate interest pursued; the necessity of the processing; and a balancing test against the rights and freedoms of the data subject.
The Court emphasizes that this assessment must be carried out in a concrete and documented manner prior to the processing taking place.
This judgment serves as a reminder of the methodology applicable to one of the most frequently invoked legal bases, applying it in practice to the publication of data required by FIFA’s rules (CJEU, 16 July 2026, C‑209/23 – RRC Sports).
Statutory disclosure of personal data: requirement for adequate safeguards
In the Jautiva case, the CJEU was asked to rule on the compatibility with the GDPR of national legislation requiring the publication, in a publicly accessible register, of information relating to the shareholders of certain companies.
The Court reiterates that where legislation provides for the disclosure of personal data, this must be accompanied by sufficient safeguards to prevent the risk of abuse and to ensure the effective protection of data subjects. In the absence of such safeguards, particularly where the information is freely accessible online, the interference with the rights guaranteed by the GDPR and the Charter of Fundamental Rights of the European Union may appear disproportionate.
This decision confirms that the public interest objectives pursued by the legislator do not exempt the legislator from establishing appropriate mechanisms for the protection of personal data (CJEU, 3 September 2026, C-798/24, Jautiva).
AI: the EDPS publishes guidance on the handling of complaints
The European Data Protection Supervisor (EDPS) has published guidance on the handling of complaints lodged under the AI Act. This mechanism enables natural or legal persons to report possible breaches of the provisions of the Regulation in cases falling within the EDPS’s jurisdiction.
The document sets out, in particular, the conditions for the admissibility of complaints, the information that may be submitted to the authority, and the procedures for investigating reports received.
GDPR sanctions: the EDPB clarifies its methodology for calculating fines
On 17 September 2026, the European Data Protection Board adopted new guidelines on the exercise of national authorities’ power to impose sanctions.
The document formalizes a methodology setting out the various steps leading to the determination of a fine’s amount and aims to promote a more harmonized application of the GDPR within the European Union.
These guidelines help to enhance the predictability of penalties imposed by supervisory authorities.
Proposal for a common legal basis to facilitate collaboration between European digital regulators
On 17 July, the EDPB called on the European Commission to establish a legal basis enabling the sharing of information between regulatory authorities operating in different digital sectors.
Given the increasing number and complexity of cases, particularly those relating to AI, the EDPB believes that such cooperation, including with regard to confidential information, would enhance the effectiveness of investigations and the consistency of the application of the GDPR.
This initiative reflects the convergence of various European digital regulations, particularly in the areas of data protection, artificial intelligence and digital services.
The EDPB sets out the conditions for blockchain compliance with the GDPR
On 7 July 2026, the EDPB adopted its guidelines on the processing of personal data using blockchain technologies.
The Committee reiterates that the use of blockchain in no way exempts organizations from compliance with the GDPR and recommends, in particular, limiting the storage of personal data directly on the chain.
It also emphasizes the importance of mechanisms to ensure compliance with the principles of data minimization and the rights of data subjects.
EDPB guidelines on anonymization
On 8 July 2026, the EDPB adopted guidelines on the anonymization of personal data. These specify the conditions under which data may be considered truly anonymous, thereby allowing for an exemption from the application of the GDPR.
The Committee proposes three assessment criteria based on the absence of isolation, correlation and inference. These guidelines provide a useful tool for assessing whether data can be considered to fall outside the scope of the GDPR.
These guidelines are in line with recent case law from the CJEU requiring that re-identification of individuals must remain reasonably impossible (see our previous newsletter).
Irish Data Protection Authority fines Google €403 million for several breaches of the GDPR
On 21 September 2026, the Irish Data Protection Authority fined Google €403 million following an investigation into the processing of location data.
The authority identified several breaches of the principles of lawfulness, transparency and data retention limits.
This decision serves as a reminder that the processing of geolocation data requires particularly clear information to be provided to users, as well as strict controls over retention periods and the legal bases relied upon.
Configuration error: penalty for unauthorized disclosure of candidates’ data
On 18 September, the Spanish data protection authority imposed a penalty on an organization following a configuration error that allowed unauthorized access to documents submitted as part of a recruitment process.
The investigation revealed that certain documents had been made public by default, exposing the personal information of several hundred people.
This decision serves as a reminder that a configuration error may render the data controller liable where it leads to the unauthorized disclosure of personal data.
Penalty imposed on the HD Hyundai Group for inadequate security measures
On 27 August 2026, the South Korean regulator fined two companies within the Hyundai HD Group – HD Construction Equipment and HD Korea Shipbuilding & Offshore Engineering – a total of 78.3 million won (approximately €49,000) for breaches of personal data security measures.
The investigation revealed that a hacker had exploited an unpatched vulnerability on a management server and then taken advantage of the insufficient network segregation. This breach enabled the hacker to gain access to the personal data of 9,503 employees and partners.
This decision is a reminder of the importance of vulnerability management, information system segregation and keeping security patches up to date.
Article written by: Jeanne BRETON, Pierre-Emmanuel MEYNARD and Camille PECNARD