Closed CNIL injunctions, European Health Data Space, smart glasses: October 2026 news roundup
Every month, we deliver the essential data news to you in our newsletter Data4Coffee. Don't miss out on the key updates!
To receive it, please fill out this form.
I. FRANCE
1.1. Right of access and rectification: The Council of State confirms the CNIL's closure of a complaint against the operator of the service-public.gouv.fr website
[October 7, 2026] A user accused the Directorate of Legal and Administrative Information (DILA), which manages the service-public.gouv.fr website, of violating their rights of access and rectification under the GDPR. According to the user, DILA had not provided all the required information and had refused to record their judicial acquittal and the diplomatic status they claimed in their data. The user filed a complaint with the CNIL citing these two failures. However, the CNIL closed the complaint in 2025, considering that DILA had indeed transmitted all the data from their online file to which it had access.
Indeed, in accordance with the decree of February 24, 2016, DILA could not consult the documents uploaded to the user's personal storage space, which only the user could modify, and it had, in fact, directed the user to the Data Protection Officer of the Ministry for Europe and Foreign Affairs. Given these elements and due diligence, the CNIL and subsequently the Council of State concluded that DILA had not committed any error of law or assessment regarding the data subject's rights of access and rectification.
Source: https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2026-10-07/509210
1.2. Job seeker data security: The CNIL's injunction against France Travail is closed
[October 8, 2026] In January 2026, following a data breach that occurred in 2024, the CNIL's restricted committee imposed a 5 million euro fine on France Travail for failing to meet security obligations. It also ordered the agency to implement four sets of corrective measures, subject to a penalty of 5,000 euros per day of delay (deliberation no. SAN-2026-003 of January 22, 2026).
In a deliberation published on October 8, 2026, the CNIL noted that the operator had complied with each of the corrective measures within the deadlines. France Travail has tightened its password policy, with fewer attempts allowed before lockout and mandatory renewal. The organization also demonstrated the use of multi-factor authentication for advisor accounts since 2004 and now actively monitors activity logs, thanks to alert thresholds continuously adjusted by a machine learning tool. Finally, advisors now only access data necessary for their duties; they no longer have access to the national identification number (NIR) or to individuals located outside their geographical area. The CNIL closed the injunction issued on January 22, 2026, against FRANCE TRAVAIL, without liquidating the planned penalty, given its compliance.
Source: http://legifrance.gouv.fr/cnil/id/CNILTEXT000054958571
1.3. Advertising cookies and Gmail ads: Google has complied with the CNIL's injunction issued in September 2025
[October 14, 2026] In a decision published on October 14, the CNIL's restricted committee closed the injunction issued on September 1, 2025, against Google LLC and Google Ireland Limited. This injunction accompanied a 325 million euro fine. Both companies had six months to comply, subject to a penalty of 100,000 euros per day of delay: they were required to clearly inform users located in France that creating a Google account results in the placement of advertising cookies. The companies were also required to obtain user consent before displaying ads in Gmail that resemble emails, slipped among their private messages.
Consequently, Google has added explicit information about cookie placement to its account creation process, presenting it as the trade-off for the free service. Google has also modified its Gmail ads so that they are clearly distinguishable from real emails. Consent is therefore no longer required under Article L. 34-5 of the Post and Electronic Communications Code. The CNIL specifies that this closure of the injunction only applies to the scope of the injunction itself. The CNIL is not ruling on the compliance of the entire account creation process. Further audits therefore remain possible, despite the closure of the injunction.
Source: <aux translate="no">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054978945</aux>
1.4. Reconstructing professional email addresses: the CNIL clarifies the applicable framework and individual rights
[October 16, 2026] The CNIL has published two fact sheets dedicated to the reconstruction of professional email addresses: one for professional organizations and the other for the individuals concerned. This practice involves deducing a person's email address from information available online (last name, first name, employer) and the employer's email format (firstname.lastname@company.fr). It is primarily used for B2B prospecting. The CNIL reiterates that data accessible online remains subject to the GDPR and that reconstruction may be based on the data controller's legitimate interest. The interest pursued must be genuine, and the processing must not disproportionately infringe upon the rights of individuals. To assess the impact on individual rights, one must also consider the reasonable expectations of the individuals, which depend on their online visibility and the care they take to protect their contact information. Indeed, a person who is absent from the internet, or who hides their contact details, does not reasonably expect such reconstruction. Finally, the data controller must clearly inform individuals, particularly regarding the purpose pursued, the origin of the email address, and how to exercise their rights.
Public bodies wishing to reconstruct professional email addresses may rely on the legal basis of performing a task carried out in the public interest.
Source: <aux translate="no">https://www.cnil.fr/fr/reconstitution-adresses-professionnelles-quel-cadre</aux> ; <aux translate="no">https://www.cnil.fr/fr/reconstitution-adresses-professionnelles-vos-droits</aux>
For more information on the protection of professional data, you can consult our article: <aux translate="no">https://www.squairlaw.com/fr/blog/donnees-personnelles-les-professionnels-sont-de-plus-en-plus-proteges</aux>
1.5. Cookies and mobile applications: the CNIL fines Fnac Darty 7 million euros
[October 29, 2026] The CNIL has fined companies within the Fnac Darty group a total of 7 million euros (6 million against Fnac Darty Participations et Services and 1 million against Fnac Direct). The proceedings follow a complaint from the association noyb regarding the placement of trackers in the FNAC mobile application without the prior consent of users. The application automatically transmitted a user identifier and browsing activity (such as products viewed) to a third-party domain in order to provide the user with product recommendations and train the recommendation algorithm. The CNIL determined that this tracker did not qualify for any exemption from consent, as it was used, among other things, for commercial targeting.
The CNIL accompanied the fine with an injunction: the companies must demonstrate, within one month of notification, that a new consent collection tool is operational, subject to a penalty of 10,000 euros per day of delay.
Source: <aux translate="no">https://www.cnil.fr/fr/sanction-cookies-app-fnac</aux>
For more information on this decision and the rules applicable to cookies, you can consult our article <aux translate="no">https://www.squairlaw.com/fr/blog/cookies-et-recommandations-personnalisees-sanction-de-7-millions-deuros-a-lencontre-de-fnac</aux>.
2. EUROPEAN UNION
2.1. Security of paper medical records: the Irish DPC sanctions Children’s Health Ireland
[October 1, 2026] The Irish Data Protection Commission (DPC) has published its final decision regarding security failures committed by Children’s Health Ireland (CHI). The Irish authority had been alerted by whistleblowers and subsequently conducted an unannounced inspection on July 16, 2025, which revealed that children's health records were being kept on paper in a poorly secured office at a university hospital. Furthermore, a confidential waste bin located near the office was overflowing with documents containing sensitive data.
The DPC found a violation of the GDPR's integrity and confidentiality principle as well as the security obligation contained therein. It issued a reprimand and ordered CHI to finalize two Data Protection Impact Assessments (DPIAs): one concerning the processing of medical records and the other concerning the management of confidential waste. CHI must fully implement the technical and organizational measures identified therein and submit these DPIAs to the DPC within four weeks. This decision serves as a useful reminder that GDPR security requirements apply just as much to paper as they do to digital records.
2.2. Baptismal registers and the right to erasure before the CJEU: the Advocate General's opinion (Case C-12/25, Bisdom Gent)
[October 1, 2026] A Belgian national who was baptized as a child had requested that the Diocese of Ghent erase his personal data from the church's registers. The diocese had merely crossed out his data, which remained legible, and noted his departure from the Church.
The CJEU has been referred a preliminary question in this case. At this stage, the Advocate General has taken the view that since the baptismal register is indeed a structured file within the meaning of the GDPR, the regulation applies. The Advocate General considers that the processing of data prior to the request could have been lawful without the express consent of the data subject, and that the individual may obtain the erasure of their data by formally objecting to the processing. The Church would then only be able to retain the data by demonstrating compelling legitimate grounds. It will be up to the national court to concretely weigh the individual's privacy, data protection, and freedom of conscience against the interests of the Church. Alternatively, archival purposes in the public interest or historical research could justify the retention of data, under strict conditions.
Finally, crossing out data is not sufficient to erase it: it must be rendered illegible.
We are awaiting the Court's decision on this matter.
Source: https://curia.europa.eu/site/upload/docs/application/pdf/2026-10/cp260139en.pdf
2.3. Video surveillance and AI: the Spanish data protection authority issues two warnings to municipalities
[October 6, 2026] The Spanish Data Protection Agency (AEPD) has issued warnings to two municipalities, based on Article 58(2)(a) of the GDPR. Their video surveillance projects included the automated analysis of images using artificial intelligence. The first involves facial detection and/or recognition functions. The second provides for the detection of people and vehicles, the generation of metadata, and the searching for individuals based on their appearance (clothing, hair, gender, age range), including from a photograph.
These warnings are preventive in nature: they concern processing that has not yet been implemented and do not, in themselves, mean that an infringement has been committed. The AEPD acknowledges that these systems, if well-designed and properly used, can make certain public services more efficient. However, it reiterates that a technology is not justified simply because it exists. Each feature must serve a specific purpose and pass a necessity and proportionality test. Data protection must be integrated into the project from the design stage. A prior impact assessment is required, particularly because video surveillance projects involve the processing of biometric data that can uniquely identify a person. Finally, data subjects must receive clear, accessible, and understandable information about the processing, its purposes, and the role of the AI system.
2.4. European Health Data Space – Entry into force of Implementing Regulations (EU) 2026/2083 and 2026/2099 regarding the MyHealth@EU platform
[October 12, 2026] The Commission adopted two implementing regulations on September 18 and 21, 2026, which were published in the Official Journal of the European Union. They specify the implementation of MyHealth@EU, the future central interoperability platform for health data provided for by Regulation (EU) 2025/327 on the European Health Data Space (EHDS). This platform will be used for the cross-border exchange of electronic health data by making relevant information accessible when a patient is treated in another Member State.
Implementing Regulation (EU) 2026/2083 sets the operating rules for the platform and establishes requirements for technical and semantic interoperability, data protection, cybersecurity, and operations. It also governs the connection of national contact points for digital health, technical and periodic compliance checks, and the notification of significant incidents. The Commission will also provide a reference software implementation and a central terminology service.
Implementing Regulation (EU) 2026/2099 creates an interoperable mechanism for the identification and authentication of patients, healthcare professionals, and healthcare providers. The goal is to reliably link data to the correct person and protect it against unauthorized access. Before any exchange request, the requesting professional or provider must be identified, authenticated, and authorized. The mechanism also organizes the notification, publication, and exchange of health attributes and identification data between national contact points. Member States must specify the information used to identify patients by March 26, 2028, at the latest. This information may be provided via the European Digital Identity Wallet, the use of which will remain optional.
Both texts apply for the most part starting March 26, 2027, with a gradual rollout. Patient summaries, electronic prescriptions, and electronic dispensations must be exchangeable by March 26, 2029, the date of application for provisions relating to the European Digital Identity Wallet. Medical images, laboratory results, and discharge reports will follow, starting March 26, 2031.
Source: https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32026R2099 ; https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32026R2083
2.5. Transfers outside the EU: the EDPB gives a favorable opinion on the Michelin Group's Binding Corporate Rules
[October 13, 2026] Following the CNIL’s draft decision approving the Michelin Group’s "controller" Binding Corporate Rules (BCR-C), the EDPB has also approved the draft. Provided for in Article 47 of the GDPR, BCRs allow an international group to regulate the transfer of personal data to its companies established outside the European Economic Area. They take the form of an intra-group policy that is legally binding for each of its entities. Referral to the EDPB is a mandatory step in the approval process led by the competent authority, in this case, the CNIL. Following this favorable opinion, the CNIL will be able to adopt its final approval decision, which will be published along with the Committee's opinion. This opinion joins a series of recent approvals of BCR-Cs reviewed by the EDPB, notably for the Flutter, DSM-Firmenich, and TGS groups.
Source: https://www.edpb.europa.eu/system/files/2026-10/edpb_opinion_242026_fr_sa_michelin_bcr-c_en_0.pdf
2.6. Smart glasses: the EDPB provides its first guidance on data protection issues
[October 13, 2026] During its latest plenary session, the European Data Protection Board (EDPB) adopted a statement on smart glasses and also published a report titled "The Connected Gaze," commissioned at the proposal of the CNIL. This initial position provides preliminary guidance to users, manufacturers, and the service providers involved.
The EDPB reiterates that the user's status depends on how they use the device: they are a data controller when they share images on a public social media account, or when they use their glasses in a professional, official, or political context. Manufacturers and associated service providers cannot shift their obligations onto users; they must also ensure that any further processing remains compatible with the initial purpose. Transparency remains the central issue, as the discreet nature of these devices often prevents the people being filmed from knowing that they are. The report further highlights that these glasses can become tools for surveillance between individuals and create power imbalances between the wearers and the people being filmed. Finally, the EDPB encourages the development of industry standards and awareness-raising initiatives.
2.7. Norway – Targeted advertising on Grindr: Norwegian authority fines Xandr 8.6 million euros
[October 16, 2026] The EDPB has relayed the final decision of October 2, 2026, by which the Norwegian Data Protection Authority (Datatilsynet) imposed an 8.6 million euro fine on Xandr Inc. (formerly AppNexus, now a subsidiary of Microsoft). The case originated from a complaint filed in 2020 by the Norwegian Consumer Council regarding real-time bidding offered within Grindr, a geolocation-based dating app for gay, bi, trans, and queer people.
The Norwegian authority considers that, during these auctions, Xandr processed data belonging to Grindr users: at a minimum, the fact that they were using the app, their advertising ID, and their IP address, which are personal data, but also data concerning sexual orientation—sensitive data for which only explicit consent could justify the processing. Xandr is classified as a joint controller; however, Xandr did not collect this consent itself and relied on the consent obtained by Grindr, which is invalid under Articles 4(11) and 7 of the GDPR. For the authority, each joint controller must verify for themselves that the consent is valid and covers their own processing. The breaches concern central provisions of the GDPR and sensitive data, and are therefore considered highly serious. The fine penalizes both processing without a legal basis and the processing of sensitive data without a valid foundation.
2.8. Data protection and value creation in finance: European authorities publish a joint study with best practices
[October 16, 2026] The CNIL, the Luxembourg National Commission for Data Protection (CNPD), and the UK Information Commissioner’s Office (ICO) have published a joint study on data protection as a lever for value creation in finance. The report starts from a simple observation: data has become a strategic asset, particularly for developing artificial intelligence systems, so it is essential to examine how data protection, beyond mere compliance, can strengthen trust in these assets and support their valuation. Compliance with the GDPR is presented as an asset when dealing with clients, partners, and investors. Conversely, poor risk management or non-compliance can depreciate an asset by exposing it to reputational, financial, and operational risks.
The report proposes best practices for integrating these issues into financial operations, particularly concerning mergers and acquisitions and due diligence, where these issues can impact asset valuation and pricing. The study also addresses the accounting of data as intangible assets under IFRS standards. Finally, surveys conducted among companies show that they know how to measure the risks associated with their data, but struggle much more to assess its value.
Source: https://www.cnil.fr/fr/protection-donnees-valeur-finance-etude-autorites-europeennes
2.9. AI training platform: noyb files five complaints against Scale AI for illicit worker surveillance
[October 27, 2026] The organization noyb has filed five complaints against Scale AI in France, Italy, the Netherlands, and Austria. Scale AI is an American company that operates Outlier, an AI training platform. More than 900,000 "independent" workers solve tasks there, such as writing prompts or classifying responses. Its clients include Meta, OpenAI, Google, and the US government. According to noyb's technical analysis, trackers from TikTok, LinkedIn, Facebook, Sprig, and Datadog are placed on the workers' devices. Every few seconds, they send IP addresses, contact details, unique identifiers, and the page being viewed to third parties. This data can be used for targeted advertising and profiling.
Scale AI also imposes repeated biometric verification on contractors, handled by the company Persona: workers must film their faces and upload their ID documents. Scale AI cites fraud prevention and skills verification as the reasons. However, noyb alleges three breaches by Scale AI in this context: the company places trackers without a legal basis or consent, it fails to respect data minimization for both trackers and biometrics, and it has not responded to data subject access requests. Furthermore, Persona suffered a leak of approximately 70,000 ID photos in October 2025. noyb is requesting a full investigation and suggests that the European authorities involved sanction the company.
Source: https://noyb.eu/en/ai-training-platform-outlier-illegally-surveils-european-platform-workers
Caroline Chancé, Jeannie Mongouachon, Clémentine Beaussier, Victoire Grosjean and Juliette Lobstein
.png)
