For the first time since its creation in 1978, the
French Data Protection Authority (the
"CNIL") fined not only a data controller, but also its
data processor.
On January 27, 2021, the CNIL imposed a 75 000 euros penalty on a processor
due to insufficient security measures.
Although unpublished, this decision is unprecedented both in its
reasoning and its consequences.
This new approach completely shifts the contractual balance
between processors and controllers.
Where processors used to rely on their status under the GDPR to
exclude or limit their liability, they are now required to provide
data controllers with the most appropriate security measures.
As for controllers, this decision incidentally confirms a
forthcoming wave of audits to be operated in order to make sure
that all the security standards imposed on their processors are
actually met.
