CNIL (French data protection authority)
The independent administrative authority responsible for personal data protection in France, recipient of breach notifications and author of the sanctions whose amounts weigh on cyber losses.
The Commission nationale de l'informatique et des libertés, created by the law of January 6, 1978, is the supervisory authority responsible in France for applying the General Data Protection Regulation. It advises, inspects and sanctions. It receives the data breach notifications that controllers must send within seventy-two hours when a breach poses a risk to individuals, investigates complaints, conducts on-site and online inspections, and can impose penalties of up to twenty million euros or four percent of worldwide turnover. It also publishes recommendations, on security, cookies or artificial intelligence, which in practice set the expected level of diligence. For cyber insurance, the commission appears at several points: notification is a mandatory step in crisis management, whose omission is itself sanctionable; the ensuing investigation generates defense costs often covered; and sanctions, in principle uninsurable, make the authority's severity visible. Its annual inspection priorities tell the underwriter where regulatory risk will concentrate.
In December 2021, the commission fined two companies of the same search engine group a total of 150 million euros for making refusing cookies harder than accepting them. No policy could pay the fine, but the defense costs of the proceedings fell under investigation cover.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.