The Commission Nationale de l'Informatique et des
Libertés (CNIL) is an independent French administrative
regulatory body whose mission is to ensure that the collection,
storage, and use of personal data comply with data privacy law.
This simplified procedure, established in law since 2022 at the
initiative of the CNIL, allows for the imposition of swift
penalties for cases that do not present particular difficulties,
compared with so-called "ordinary" sanctions.
When a breach of the General Data Protection Regulation (GDPR)
or the French Data Protection Act is identified, the CNIL may
initiate a simplified sanction procedure against an organization if
the case does not pose any particular challenges. Simplified
sanctions are not made public, and the amount of fines that can be
imposed cannot exceed €20,000.
