{"id":127435,"date":"2026-11-12T09:40:37","date_gmt":"2026-11-12T08:40:37","guid":{"rendered":"https:\/\/ceadigilaw.org\/?p=127435"},"modified":"2026-11-12T09:40:45","modified_gmt":"2026-11-12T08:40:45","slug":"france-cnil-fines-local-bodies-nis-2-bill","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/ar\/blog\/france-cnil-fines-local-bodies-nis-2-bill\/","title":{"rendered":"France: CNIL fines ten local bodies as NIS 2 bill reaches the Assembly"},"content":{"rendered":"<div lang=\"en\" dir=\"ltr\">\n<div class=\"cea-blog-resumen\">\n<p><strong>In brief<\/strong><\/p>\n<ul>\n<li>On 9 November 2026 CNIL announced simplified-procedure fines of between EUR 3,000 and EUR 20,000 on ten local authorities and one public body.<\/li>\n<li>The failings sanctioned (permanent supplier access, administrators without MFA, unused logs) overlap with NIS 2 requirements.<\/li>\n<li>The R\u00e9silience bill, transposing NIS 2, reached the National Assembly floor the same day and would raise the number of regulated entities from about 500 to nearly 15,000.<\/li>\n<\/ul>\n<\/div>\n<p>France&#8217;s Commission nationale de l&#8217;informatique et des libert\u00e9s (CNIL) has announced fines on ten local authorities and one public body over cybersecurity failings, and the R\u00e9silience bill, which transposes the NIS 2 directive, has reached the floor of the National Assembly. Both developments point at the same weaknesses, as reported by <a href=\"https:\/\/itsocial.fr\/cybersecurite\/cybersecurite-articles\/acces-des-prestataires-authentification-des-administrateurs-la-cnil-sanctionne-dix-collectivites\/\" target=\"_blank\" rel=\"noopener\">IT Social<\/a>.<\/p>\n<h2>What CNIL sanctioned<\/h2>\n<p>On 9 November 2026 CNIL announced ten penalties under its simplified procedure for breaches of the GDPR and the Informatique et Libert\u00e9s law. The fines range from EUR 3,000 to EUR 20,000, the ceiling of that procedure, and were adjusted to the seriousness of the failings, the data processed, each body&#8217;s budget and remedial steps already taken. CNIL does not publish the names.<\/p>\n<p>The failings, under Article 32 GDPR (security appropriate to the risk), include remote connections with weak authentication, administrators without multi-factor authentication (MFA), servers running unsupported operating systems, weak passwords, and software suppliers with permanent network access or shared accounts. Incomplete or unused logs and weak network segmentation were also noted.<\/p>\n<p>Other decisions concern online services launched without the security accreditation required of administrative authorities, and the lack of a data protection impact assessment (Article 35 GDPR) for school services for families and for public-road video surveillance. CNIL says it will devote half of its 2026 inspections and enforcement to data security.<\/p>\n<h2>The R\u00e9silience bill and NIS 2<\/h2>\n<p>The R\u00e9silience bill reached the plenary of the National Assembly on 9 November. According to the source, the number of regulated entities would rise from about 500 to nearly 15,000. It is not yet adopted or in force: the rest of the parliamentary process remains.<\/p>\n<p>Article 21 of NIS 2 lists supply chain security, multi-factor authentication and incident handling, while Article 23 provides for an early warning within 24 hours and a notification within 72 hours. An organisation that does not log its suppliers&#8217; access will struggle to meet those deadlines.<\/p>\n<h2>What to prepare<\/h2>\n<ul>\n<li>Inventory suppliers&#8217; remote access and remove shared accounts.<\/li>\n<li>Grant access on request, traced and time-limited.<\/li>\n<li>Enforce MFA on all privileged accounts and retire unsupported systems.<\/li>\n<li>Actually analyse logs and review supplier contracts.<\/li>\n<\/ul>\n<h2>Our view at CEA Digital Law<\/h2>\n<p>The French case shows that NIS 2 compliance does not start on the day of transposition: data protection regulators already expect equivalent measures. For EU Member States still transposing, and for Latin America and the Caribbean or Africa, where cybersecurity frameworks are under discussion, the lesson is that a single set of controls (MFA, traceability, third-party management) serves both regimes.<\/p>\n<p>We suggest two lines of action. First, going from 500 to 15,000 entities calls for support for the smallest ones: joint procurement, IT associations and public digital operators can secure supplier clauses that one municipality cannot negotiate alone. Second, closer coordination between data protection and cybersecurity authorities would avoid duplicated burdens. Open question: whether local bodies will have the staff and budget to sustain these obligations.<\/p>\n<h2>Sources<\/h2>\n<ul class=\"cea-blog-fuentes\">\n<li><a href=\"https:\/\/itsocial.fr\/cybersecurite\/cybersecurite-articles\/acces-des-prestataires-authentification-des-administrateurs-la-cnil-sanctionne-dix-collectivites\/\" target=\"_blank\" rel=\"noopener\">IT Social<\/a><\/li>\n<\/ul>\n<p class=\"cea-blog-firma\"><em>CEA Digital Law<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>CNIL has fined ten local authorities over cybersecurity failings while the R\u00e9silience bill (NIS 2) reaches the floor, raising regulated entities from 500 to 15,000.<\/p>\n","protected":false},"author":2,"featured_media":127436,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1120],"tags":[],"cea_women":[],"class_list":["post-127435","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ciberseguridad-ar"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/posts\/127435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/comments?post=127435"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/posts\/127435\/revisions"}],"predecessor-version":[{"id":127465,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/posts\/127435\/revisions\/127465"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/media\/127436"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/media?parent=127435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/categories?post=127435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/tags?post=127435"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/cea_women?post=127435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}