Who was sanctioned, and for what?

On 24 July 2026 Arcom imposed a fine of EUR 200,000 on Société d'exploitation d'un service d'information (SESI), the operator of the news channel CNews. In Arcom's view, two programmes broadcast in June and September 2025 contained statements about people of (presumed) immigrant background and Muslims, without sufficient context or challenge, that were capable of inciting hatred and discrimination; Arcom considered this a breach of Article 15 of Law No 86-1067 and of the channel's contractual obligations on non-discrimination and control of its programming. In setting the amount, Arcom took into account earlier sanctions against SESI for breaches of the same obligations in 2021 and 2024. Arcom did not sanction a third programme it examined. Whether the decision has been appealed is not known here.

Authority / court

Autorité de régulation de la communication audiovisuelle et numérique (Arcom)

Area of law

Other

Legal basis

Art. 15, 42-1 und 42-2 Loi n° 86-1067 du 30 septembre 1986 (liberté de communication); Art. 2-2-1 und 2-3-2 der Vereinbarungen vom 27. November 2019 und 10. Dezember 2024

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

29 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined the IT and engineering consultancy EXTIA EUR 300,000 because, of 265 erasure requests received in 2024 – mostly from job applicants, occasionally from former employees – 12 were not processed at all and 166 applicants were not told of the outcome; 27 received their reply only after the one-month deadline. The CNIL regarded this as particularly negligent, especially as the company had already been reminded of its obligations by the CNIL twice in 2024 (Art. 12 and 17 GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 und 17 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Culpability

negligent

Repeat case

yes

Mitigating circumstances

During the proceedings the company deleted the data concerned and informed the applicants retrospectively.

Published

9 Sep 2026

Checked against the official source on 2 Oct 2026 · Direct link

At the request of the press association Alliance de la Presse d’Information Générale (APIG), the Autorité de la concurrence (French Competition Authority) imposed interim measures on Meta because its conduct in negotiations on remuneration for press publishers’ neighbouring rights could amount to an abuse of a dominant position. Meta must negotiate in good faith on remuneration for all Meta services from 1 February 2025, provide the information needed for the assessment within 15 days, must not degrade the display of press content during the negotiations and must report to the authority monthly. On the same day a similar decision (26-MC-02) was issued at the request of the collective management organisation DVP.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. L. 464-1 Code de commerce (mesures conservatoires); vorläufige Würdigung nach Art. L. 420-2 Code de commerce und Art. 102 AEUV; Art. L. 218-4 Code de la propriété intellectuelle

Action

Order

Status of proceedings

under appeal

Sector

Media and online platforms

Employees

10,000 or more

Published

8 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

In an action brought by Notre Affaire à Tous, Sherpa, ZEA, France Nature Environnement and the City of Paris, the Paris Judicial Court (Tribunal judiciaire de Paris, 34th chamber) ruled that climate risks fall under the French duty of vigilance law and that Scope 3 emissions are part of the oil and gas group's activities. The vigilance plan without Scope 3 is incomplete, the court held; TotalEnergies must supplement it within six months, with provisional enforceability, and implementation will be reviewed by the court in January 2027.

Authority / court

Tribunal judiciaire de Paris (34. Kammer)

Area of law

Supply chain and human rights · Supply chain due diligence

Legal basis

Art. L.225-102-1 und L.225-102-2 Code de commerce (Loi n° 2017-399, devoir de vigilance); Art. 1252 Code civil

Action

Order

Status of proceedings

unknown

Sector

Energy and utilities

Employees

10,000 or more

Published

25 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

According to the AMF (Autorité des marchés financiers, French financial markets authority) Enforcement Committee, the online broker Bourse Direct did not properly submit its transaction reports under Art. 26 MiFIR between January 2021 and November 2023 and did not maintain an adequate system to detect and report suspicious orders and transactions under Art. 16(2) MAR. The company received EUR 800,000. The amount covers only the sanction imposed on the company.

Authority / court

Autorité des marchés financiers (AMF), Commission des sanctions

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 26 Verordnung (EU) Nr. 600/2014 (MiFIR); Art. 15 Delegierte Verordnung (EU) 2017/590; Art. 16 Abs. 2 Verordnung (EU) Nr. 596/2014 (MAR); Art. 2, 3 Delegierte Verordnung (EU) 2016/957

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

50 to 249

Published

25 Jun 2026

Checked against the official source on 2 Oct 2026 · Direct link

The CNIL (French data protection authority) fined IQVIA Operations France EUR 5,000,000 because, for two health data warehouses authorised by the CNIL (fed with data from around 14,000 pharmacies and several thousand medical practices), the company did not comply with the conditions of the authorisations, including log analysis, multi-factor authentication, patient information and the right to object. In addition, pharmacy customers were not informed of the transfer of their data, in-house studies were carried out without the required authorisation and the pharmacy software transmitted data even after a refusal (Art. 25 GDPR). The CNIL classified the data as pseudonymised rather than anonymous and ordered remedial action within six months, subject to a penalty payment of EUR 10,000 per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 14 und 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The security shortcomings were remedied after the inspections.

Published

28 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

Pyrolysis oil leaked twice at the Lavéra petrochemical site in Martigues: around 50 tonnes in July 2018 through a failed seal into the Anse d'Auguette, part of which reached the sea, and around one tonne in April 2022 through a corroded seawater pipe, of which some 500 kg reached the Anse d'Auguette. Naphtachimie therefore concluded an environmental CJIP (convention judiciaire d'intérêt public, French deferred prosecution agreement) with the Marseille public prosecutor; it pays a public interest fine of 1,200,000 EUR, compensates two environmental associations and will trial, at its own expense, a biological clean-up of the Anse d'Auguette; validated on 13 May 2026.

Authority / court

Parquet de Marseille (Procureur de la République); Validierung durch den Präsidenten des Tribunal judiciaire de Marseille

Area of law

Environment and sustainability · Emissions and permits

Legal basis

Art. 41-1-3 Code de procédure pénale (pollution des eaux)

Action

Fine

Status of proceedings

final

Sector

Chemicals and pharmaceuticals

Published

26 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

Through the association Synadis Bio, market participants ensured for more than seven years that organic brands were not sold simultaneously in specialist organic shops and in conventional supermarkets, in order to prevent price comparisons (decision 26-D-05). Fines: Synadis Bio 10 million EUR, Greenweez/Carrefour 1.85 million EUR, ITM 740,000 EUR, Les Comptoirs de la Bio 80,000 EUR.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Cartels and collusion

Legal basis

Art. L.420-1 Code de commerce, Art. 101 Abs. 1 AEUV; Bußgeldbemessung nach Art. L.464-2 Code de commerce

Action

Fine

Status of proceedings

under appeal

Sector

Food and agriculture

Published

16 Apr 2026

Checked against the official source on 25 Sep 2026 · Direct link

From 13 May 2015 to 20 November 2023, Nexans granted companies of the Sonepar group exclusive rights to import Nexans cables into La Réunion, Mayotte, French Guiana, Martinique and Guadeloupe, which Art. L. 420-2-1 of the Code de commerce (French Commercial Code) prohibits for the overseas territories. In a settlement procedure the Autorité de la concurrence (French Competition Authority) imposed EUR 3 million on Nexans France (jointly with Nexans SA) and EUR 3.5 million on the Sonepar companies involved, EUR 6.5 million in total. It is the authority’s first decision based on a report by a person with protected whistleblower status.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Cartels and collusion

Legal basis

Art. L. 420-2-1 Code de commerce; Vergleichsverfahren nach Art. L. 464-2 III Code de commerce

Action

Fine

Status of proceedings

under appeal

Sector

Manufacturing and mechanical engineering

Mitigating circumstances

Settlement procedure (transaction): the companies did not contest the objections.

Published

2 Apr 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Malaysian subsidiary of Colas Rail paid large, undocumented sums via intermediaries in connection with public contracts for urban rail lines in Kuala Lumpur (Kelana Jaya extension, MRT2). Following an internal investigation, Colas Rail self-reported the matter in 2017; the CJIP (Convention judiciaire d'intérêt public, a French deferred prosecution agreement) provides for a public interest fine of 29,745,974 EUR and a three-year compliance programme monitored by the French Anti-Corruption Agency (AFA) (costs of up to 1.9 million EUR).

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung ausländischer Amtsträger

Action

Fine

Status of proceedings

final

Sector

Construction and real estate

Employees

10,000 or more

Culpability

intentional

Mitigating circumstances

Self-report (criminal complaint filed by Colas Rail on 31 May 2017) following an internal forensic investigation.

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

19 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

In parallel with the US declination, the PNF concluded a CJIP with the US subsidiary of the French medical technology manufacturer for 1,765,493 EUR (after crediting the US disgorgement) and a three-year AFA compliance programme. The case arose from Balt SAS's voluntary self-disclosure of 22 May 2023 concerning conduct at the acquired company Blockade Medical.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); aktive und passive Bestechung von Amtsträgern

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

250 to 999

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure to the PNF and the DOJ; coordinated resolution with crediting.

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

19 Mar 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

From 12 May 2006 to 4 February 2025, the model agreement of France’s largest ski instructors’ union prohibited instructors of the Écoles du Ski Français from teaching for competing ski schools or their own clients and threatened exclusion for breaches; the Autorité de la concurrence (French Competition Authority) regarded this as a restriction of competition by object on the market for ski tuition. It imposed EUR 3.4 million, for the first time in an ordinary procedure calculated on the basis of the members’ turnover, and ordered the union to amend the rules, publish the decision and, if it cannot pay, call on its members for contributions.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 101 Abs. 1 AEUV; Art. L. 420-1 Code de commerce; Bemessung nach Art. L. 464-2 Code de commerce (Umsetzung der ECN+-Richtlinie)

Action

Fine

Status of proceedings

under appeal

Sector

Other

Published

17 Mar 2026

Checked against the official source on 2 Oct 2026 · Direct link

From 2008 to 2011, the Paris-based supplier of betting and gaming terminals made unjustified payments of 78,972 EUR to an official of a majority state-owned company in Mali, with which it had a supply contract awarded without a tender. The case was triggered by a report from TRACFIN (the French financial intelligence unit). Public interest fine of 499,150 EUR (including 335,000 EUR already seized) and a three-year AFA compliance programme.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung ausländischer Amtsträger und Geldwäsche

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

50 to 249

Culpability

intentional

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

18 Feb 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In early 2024, attackers used social engineering to take over accounts of Cap Emploi advisers and accessed data on jobseekers from the last 20 years, including social security numbers. The French data protection authority (CNIL) criticised weak authentication, insufficient logging and overly broad access rights, and imposed 5 million EUR together with an order carrying a penalty payment of 5,000 EUR per day of delay.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Published

29 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

HSBC Bank plc concluded a CJIP (convention judiciaire d'intérêt public, French deferred prosecution agreement) with the Parquet national financier (PNF, French national financial prosecutor) concerning intra-group dividend arbitrage trading structures run through its Paris branch between 2014 and 2019, which avoided withholding tax on dividends and may be classified as aggravated tax fraud. The bank pays a public interest fine of 267,531,000 EUR; for 2019 it had already paid 34,464,424 EUR in taxes, interest and penalties. Validated on 8 January 2026.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Other

Legal basis

Art. 41-1-2 Code de procédure pénale (fraude fiscale aggravée)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Published

8 Jan 2026

Checked against the official source on 2 Oct 2026 · Direct link

Following an attack in October 2024 in which data relating to around 24 million customer contracts, including IBANs, was exfiltrated, the French data protection authority (CNIL) imposed 27 million EUR on Free Mobile and 15 million EUR on Free (42 million EUR in total). The authority objected to VPN access without adequate authentication, deficient detection of suspicious access, incomplete notification of data subjects and, at Free Mobile, excessively long retention of old contracts; orders with deadlines were also issued.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 32, Art. 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

During the proceedings, the companies introduced multi-factor authentication, a Security Operations Centre and improved logging.

Published

14 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined an unnamed retail chain EUR 3,500,000 (EUR 2,500,000 under Art. 6(1)(a), 13, 32 and 35 GDPR and EUR 1,000,000 under Art. 82 of the Loi Informatique et Libertés, the French Data Protection Act). Since 2018 the company had transferred e-mail addresses and telephone numbers of members of its loyalty programme to a social network without valid consent in order to show them targeted advertising there; more than 10.5 million people were affected. In addition, there was inadequate information, weak password rules with SHA-256 hashing, no data protection impact assessment, and cookies that were set before any choice and continued to be read after a refusal.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 lit. a, 13, 32 und 35 DSGVO; Art. 82 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Published

22 Jan 2026

Checked against the official source on 2 Oct 2026 · Direct link

In 2023, the French data protection authority (CNIL) had imposed 32 million EUR for the real-time monitoring of warehouse staff through scanner metrics. France's supreme administrative court (Conseil d'État) held that three metrics (‘Stow Machine Gun’, ‘Idle Time’, ‘Latency’) were covered by legitimate interest, but upheld the findings on the 31-day retention of all metrics, information deficiencies and security flaws in the video surveillance, and reduced the fine to 15 million EUR.

Authority / court

Conseil d'État

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c, Art. 12, 13, 32 DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Transport, logistics and shipping

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

As a processor, Nexpublica developed and operated the case management software ‘Public CRM’ for the disability authority MDPH Nord. Following two data breaches in 2022, audits revealed critical vulnerabilities that had existed since 2021, such as outdated SHA-1 hashing; the French data protection authority (CNIL) imposed 1.7 million EUR directly on the service provider.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data processors

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link