CNIL (France) - SAN-2026-009

CNIL - SAN-2026-009
Authority:	CNIL (France)
Jurisdiction:	France
Relevant Law:	Article 32 GDPR Article 34 GDPR L. 1110-4 French Public Health Code L. 1110-12 French Public Health Code
Type:	Investigation
Outcome:	Violation Found
Started:	04.06.2025
Decided:	21.07.2026
Published:	03.09.2026
Fine:	500000.0 EUR
Parties:	Hôpital Privé de la Loire
National Case Number/Name:	SAN-2026-009
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	Legifrance (in FR)
Initial Contributor:	bms

The DPA found that a hospital, victim of a data breach, lacked sufficient measures to protect the patients data pre breach and that its reaction to the breach - assigning a shared password and failing to inform 202,246 affected third parties of the breach - was in violation of Articles 32 and 34 GDPR. The DPA fined the hospital €500,000.

English Summary

Facts

In June 2025, an attacker obtained the credentials of a doctor affiliated with Hôpital Privé de la Loire, the controller, and used them to access the hospital's electronic patient record system.

Between 26 June and 1 July 2025, the attacker extracted 524,867 patient records. The compromised data included identification and contact information, social security numbers and, in some cases, identity documents and health data. The records also contained personal data relating to 202,246 persons designated by patients as trusted third parties.

After discovering the breach, the controller notified the CNIL, the DPA, and informed the affected patients through different communication channels. However, it did not directly inform the 202,246 trusted third parties whose data had also been compromised. The DPA subsequently carried out an on-site investigation into the controller's data processing practices.

The investigation identified several security deficiencies in the electronic patient record system. External users could access it remotely using only a username and password, without a VPN or multi-factor authentication. Moreover, healthcare professionals could access patient records of patients they had no relation with, the system lacked adequate proactive analysis of access logs, and the software provider had permanent access to the system without prior authorisation by the controller. Following the breach, the controller had also temporarily assigned the same password to all external practitioners when resetting their credentials.

Holding

The DPA found that the controller violated Article 32 GDPR by failing to implement appropriate technical and organisational measures to secure the electronic patient record system.

The DPA first considered that remote access by external practitioners was insufficiently protected because it relied only on a username and password, without multi-factor authentication or a VPN. Given the sensitivity and volume of the health data processed, stronger authentication measures were required. The lack of such safeguards also facilitated the breach, as the attacker accessed the system using compromised credentials.

The DPA further found that the controller's access-rights policy was too broad, since healthcare professionals could access records of patients for whose care they were not responsible. In addition, although access logs were collected, they were not analysed in real time or shortly afterwards to detect abnormal activity. This allowed the attacker to extract a very large number of records over several days without triggering an alert.

The DPA also considered that confidentiality was insufficiently protected because, after the breach, the controller temporarily assigned the same password to all external practitioners. Moreover, the software provider had permanent access to the system without prior authorisation by the controller.

The DPA additionally found a violation of Article 34 GDPR because the controller did not directly inform the 202,246 trusted third parties whose personal data had been compromised. A general notice published on the hospital's website was not sufficient to meet the obligation to communicate a high-risk personal data breach to affected data subjects.

The DPA fined the controller €500,000 and ordered it to improve log monitoring, revise its access-rights policy and restrict the software provider's access to situations where prior authorisation had been granted. The orders were subject to a penalty payment of €1,000 per day of delay.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Decision SAN-2026-009 of July 21, 2026

National Commission for Information Technology and Civil Liberties

Nature of the decision: Sanction

Date of publication on Légifrance: Thursday, September 3, 2026
Decision No. SAN-2026-009 of the Select Panel dated July 21, 2026, concerning the company HOPITAL PRIVE DE LA LOIRE

The National Commission for Information Technology and Civil Liberties, meeting in its select panel composed of Mr. Philippe-Pierre CABOURDIN, Chair, Mr. Vincent LESCLOUS, Vice Chair, Ms. Laurence FRANCESCHINI and Ms. Isabelle LATOURNARIE-WILLEMS, Mr. Didier KLING and Mr. Bertrand du MARAIS, members,

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;

Having regard to Law No. 78-17 of January 6, 1978, on Information Technology, Filing Systems, and Civil Liberties, in particular articles 20 et seq.;

Having regard to the Public Health Code;

Having regard to Decree No. 2019-536 of May 29, 2019, adopted to implement Law No. 78-17 of January 6, 1978, on Information Technology, Filing Systems, and Civil Liberties;

Having regard to Resolution No. 2013-175 of July 4, 2013, adopting the regulations of the National Commission on Information Technology and Civil Liberties;

Having regard to Decision No. 2025-1154 QPC of August 8, 2025, of the Constitutional Council;

Having regard to Decision No. 2025-125C of July 7, 2025, by the President of the National Commission for Information Technology and Civil Liberties, instructing the Secretary General to conduct or arrange for an audit of the processing operations carried out by or on behalf of the company HOPITAL PRIVE DE LA LOIRE;

Whereas the President of the National Commission for Information Technology and Civil Liberties issued a decision on February 19, 2026, appointing a rapporteur to the select panel;

Whereas the report by Ms. Anne DEBET, the reporting commissioner, was served on HOPITAL PRIVE DE LA LOIRE on March 5, 2026;

Whereas the written observations submitted by HOPITAL PRIVE DE LA LOIRE on April 3, 2026;

Having regard to the closure of the investigation, notified to the company on May 18, 2026;

Having regard to the letter from the chair of the restricted panel dated May 18, 2026, informing the company that the case was on the agenda of the restricted panel meeting on June 18, 2026;

Whereas oral observations were made during the session of the select panel on June 18, 2026;

Whereas the other documents in the case file,

The following were present at the session of the select panel on June 18, 2026:

- Ms. Anne DEBET, commissioner, whose report was heard;

Acting as representatives of HOPITAL PRIVE DE LA LOIRE:

- […]

The company HOPITAL PRIVE DE LA LOIRE having been informed of its right to remain silent regarding the allegations against it and having been given the last opportunity to speak;

The restricted panel adopted the following decision:

I. FACTS AND PROCEDURE

A. Overview of the hospital and the treatments provided

1. The company HOPITAL PRIVE DE LA LOIRE (hereinafter “HOPITAL PRIVE DE LA LOIRE” or “the hospital”) is a public limited company with a board of directors established on January 1, 1970, registered with the Saint-Étienne Trade and Companies Register under number 704 501 006 and having its registered office at 39 Boulevard de la Palle, Saint-Étienne (42100).

2. Formed through the merger of four clinics in the Saint-Étienne metropolitan area, the Hospital joined the RAMSAY SANTE Group in 2008, which describes itself as the leader in private hospitalization and primary care in Europe and the leading private healthcare provider in France, Sweden, Denmark, and Norway.

3. Between July 2023 and June 2024, the hospital generated revenue of approximately 91.8 million euros, with a net loss of 2.9 million euros, and, between July 2024 and June 2025, revenue of approximately 93.4 million euros, resulting in a net loss of 5.2 million euros. The RAMSAY Group, for its part, generated revenue of […] between July 2024 and June 2025, with a net income of […].

4. The hospital offers a full range of medical specialties (excluding dialysis, cranial neurosurgery, and heart surgery) and treated approximately 50,000 patients in 2024. It employs 566 full-time equivalent staff, including about 15 physicians, and also has a medical community of approximately 200 private practitioners (surgeons and physicians, physical therapists, midwives) who are affiliated with the hospital through practice agreements.

5. All data on patients treated at the hospital is centralized in an electronic health record (hereinafter, the EHR ), which makes it possible to track their care journey and coordinate the involvement of various healthcare providers (doctors, nurses, nursing assistants, and paramedical staff, in particular) for the purpose of providing care and administering medications and treatments.

6. The EHR is managed using the […], a web application accessible via a browser after entering a username and password. The patient records comprising the EHR (which contain all data relating to each patient) can be accessed via this application using a URL that includes a patient-specific identifier.

7. In 2025, the hospital’s EHR contained personal data for approximately 530,000 patients, including:

- administrative data: the patient’s case number, title, first and last names, date and place of birth, gender, Social Security number, mailing address, permanent patient identification number (or IPP), marital status, and employment status; the identity and contact information of a designated contact person to be notified if necessary and, in certain cases, a copy of the front side of the national ID card of the patient, their guardian/curator, or their legal representative in the case of minor patients;

- biometric data: the security photograph;

- and data concerning health: nursing, medical, and paramedical observations, both prior to and during the patient’s hospitalization.

8. Access to the EHR was possible from the hospital’s internal network, but also from outside the hospital:

- for employees of HOPITAL PRIVE DE LA LOIRE who had a hospital workstation and remote access via a VPN, which amounted to approximately 40 people, notably on-call managers;

- for users outside the hospital, namely private practitioners and their administrative staff, and employees of the software publisher responsible for maintaining the EHR. These external users logged in directly to the EHR via an internet connection, without first connecting to a VPN. This amounted to approximately 450 users.

9. A matrix of rights of access for the hospital’s electronic patient record specified each user’s rights to the various modules (administrative data, health data, etc.) based on their profile.

B. The Personal Data Breach That Occurred in June 2025

10. On July 1, 2025, the PRIVATE HOSPITAL OF THE LOIRE was contacted by a private practitioner affiliated with the hospital, who reported that he was no longer able to log in to the EHR. Following this alert, the hospital conducted an investigation that confirmed a data breach had occurred.

11. These investigations revealed that the attacker managed to log into the hospital’s electronic health records on June 26, 2025, using the login credentials of a private practitioner affiliated with the hospital. The attacker then made numerous requests to understand how the system worked and the site’s directory structure.

12. Between June 26 and July 1, 2025, he proceeded to exfiltrate 524,867 patient records containing information such as personal details, Social Security numbers, mailing and email addresses, and the permanent identification numbers of the affected patients. Among these, 46,185 records also included the front side of the national ID card of the patient or their legal representative; 43 records contained health data; and 202,246 records contained information regarding the trusted person designated by the patient (relationship, last name, first name, and phone number).

13. HOPITAL PRIVE DE LA LOIRE reported this data breach to the National Commission on Informatics and Civil Liberties (hereinafter, the CNIL or the Commission) on July 4, 2025.

14. At the same time, the CNIL received nine complaints from data subjects affected by this breach.

C. The proceedings before the CNIL

15. On July 29, 2025, a delegation from the Commission conducted an on-site inspection at the hospital’s premises, located at 39 boulevard de la Palle in Saint-Étienne (42100), to verify compliance with Law No. 78-17 of January 6, 1978, as amended, on Information Technology, Filing Systems, and Civil Liberties (hereinafter the “Data Protection Act” or “LIL”), and with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter the GDPR or the Regulation) regarding the processing operations carried out. The report drawn up at the conclusion of the proceedings was served on HOPITAL PRIVE DE LA LOIRE on August 1, 2025.

16. The hospital provided additional information to the inspection team on August 4, 2025.

17. For the purpose of reviewing this information, the Chair of the Commission appointed Ms. Anne DEBET as rapporteur on February 19, 2026, pursuant to article 22 of the amended Act of January 6, 1978.

18. On March 5, 2026, upon completion of her review, the rapporteur served HOPITAL PRIVE DE LA LOIRE with a report detailing the violations of articles 32 and 34 of the GDPR that she deemed to have occurred in this case. This report recommended that the Commission’s select panel impose an administrative fine on the company, as well as an order to bring its practices into compliance with the provisions of Article 32 of the GDPR, accompanied by a periodic penalty payment. It also proposed that this decision be made public but that it no longer be possible to identify the company by name after a period of two years from the date of its publication. 

19. On April 3, 2026, the HOPITAL PRIVE DE LA LOIRE submitted comments in response to the sanction report.

20. On May 18, 2026, the rapporteur, pursuant to article 40(III) of Decree No. 2019-536 of May 29, 2019, issued to implement the Data Protection Act (hereinafter, the Decree of May 29, 2019), informed the hospital that the investigation had been closed.

21. On the same day, the hospital was informed that the case had been placed on the agenda for the closed-door session scheduled for June 18, 2026.

22. The rapporteur and the hospital presented oral arguments during the session of the restricted panel.

II. REASONS FOR THE DECISION

A. Regarding the processing accountability of HOPITAL PRIVE DE LA LOIRE

23. In law, Article 4(7) of the GDPR defines the controller as the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the processing purposes and means; where the purposes and means of such processing are determined by Union law or the law of a Member State, the controller may be designated (…) by Union law or by the law of a Member State.

24. In this case, the processing in question relates to the electronic health record (or EHR), the purpose of which is to centralize all personal data of patients treated at HOPITAL PRIVE DE LA LOIRE in accordance with the procedures described above.

25. The company HOPITAL PRIVE DE LA LOIRE informed the delegation that it is the data controller for the processing of personal data carried out within the framework of its EHR. The hospital is also designated as the controller of these processing activities in the register maintained pursuant to Article 30 of the GDPR, as well as in the contract entered into with the company […], the publisher of the aforementioned […] software. Finally, the data protection impact assessment (hereinafter the “DPIA”), conducted at the request of the hospital’s GDPR liaison officer, confirms this accountability by specifying the processing purposes, namely to enable the maintenance and storage of the patient’s electronic medical record, under the conditions provided for and required by the Public Health Code, and detailing the means by which this is achieved.

26. The Panel notes that maintaining an electronic patient record enables healthcare facilities to comply with the obligations of Article R. 1112-2 of the Public Health Code, which provides that a medical record shall be created for each patient hospitalized in a public or private healthcare facility, and lists the elements that must be included therein.

27. In light of the foregoing and based on the evidence in the case file, the Panel considers that the hospital is responsible for the processing operations relating to the EHR, for which it has defined the purposes and essential means.

B. Regarding the breach of the obligation to ensure data security pursuant to article 32 of the GDPR

28. Legally, article 32(1) of the GDPR provides that, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and processing purposes, as well as the risks, (…) the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk (…) and, in particular, measures to ensure confidentiality, integrity, the constant availability and resilience of processing systems and services, as well as a procedure to regularly test, analyze, and evaluate the effectiveness of the technical and organizational measures to ensure the security of the processing.

29. Article 32(2) specifies that when assessing the appropriate level of security, particular account shall be taken of the risks posed by the processing, arising, in particular, from the destruction, loss, alteration, or unauthorized disclosure of personal data transmitted, stored, or otherwise processed, or from unauthorized access to such data, whether accidental or unlawful.

30. It follows from these provisions, read in light of Recital 75 of the GDPR, that when the processing in question involves special categories of personal data, such as health data, the processing must be subject to enhanced security measures.

31. Furthermore, article L. 1470-2 of the Public Health Code, which governs digital health services, provides that the use of digital health services requires the electronic identification of their users. This electronic identification relies on a means—whether physical or non-physical—that ensures an appropriate level of security and data protection for the personal data processed by the relevant digital health service.

32. A framework, established by order of the ministers responsible for health and social affairs, defines categories of digital health services based, in particular, on the service’s purposes, the type of data processed, the number of Users likely to access the service, its national or regional scope, and, where applicable, whether the service is used by healthcare professionals who simultaneously practice their profession within multiple legal entities.

33. This framework specifies, for each category of users and for each category of digital health service: (1) The minimum level of assurance required for electronic identification, (…) (2) For professionals, the required means of electronic identification.

34. Pursuant to these provisions, an executive order dated March 28, 2022, which took effect on June 1, 2022, approved and made enforceable the security framework relating to the electronic identification of users of digital health services.

35. It is therefore the responsibility of the controller to implement appropriate technical and organizational measures to ensure the confidentiality and integrity of the data processed, taking into account the specific nature of such data and the legal framework applicable to digital health services.

1. The Scope of the Security Obligation Set Forth in Article 32 of the GDPR

36. The Chamber of the Court first notes that the security obligation set forth in Article 32 of the GDPR is an obligation of means, which requires the controller to take measures that, in light of the characteristics of the processing in question, enable both a reduction in the likelihood of a data breach occurring and, where applicable, a mitigation of its severity. Security measures are therefore not expected to eliminate all forms of risk, and the mere occurrence of a data breach does not in itself constitute a breach of article 32 of the GDPR.

37. This analysis was confirmed by the CJEU in its judgment of December 14, 2023 (CJEU, December 14, 2023, C-340/21, Bulgarian National Revenue Agency, para. 29–31). The Chamber of the Court notes that, in that judgment, the CJEU held that the reference in article 32, paragraphs 1 and 2, of the GDPR to a level of security appropriate to the risk and an appropriate level of security demonstrates that this regulation establishes a risk management framework and does not in any way purport to eliminate the risks of personal data breaches. Thus, it is clear from the wording of Articles 24 and 32 of the GDPR that these provisions merely require the controller to adopt technical and organizational measures designed to prevent, to the greatest extent possible, any personal data breach. The appropriateness of such measures must be assessed on a case-by-case basis by examining whether the controller has implemented them, taking into account the various criteria set forth in those articles and the data protection needs specific to the processing in question, as well as the risks posed by such processing. Consequently, Articles 24 and 32 of the GDPR cannot be interpreted to mean that an unauthorized disclosure of personal data or unauthorized access to such data by a third party is sufficient to conclude that the measures adopted by the relevant controller were not appropriate, within the meaning of those provisions, without even allowing the data controller to provide evidence to the contrary.

38. The CJEU has more recently reiterated that this literal interpretation is supported by a combined reading of Articles 24 and 32 with Article 5(2) and Article 82 of the Regulation, read in light of Recitals 74, 76, and 83 thereof, from which it follows, in particular, that the controller is required to mitigate the risks of a personal data breach, and not to prevent any such breach (January 25, 2024, C-687/21, paragraph 39).

39. Consequently, a breach of the security obligation may be established regardless of whether a personal data breach has occurred.

40. The Chamber of the Court then notes that it may impose sanctions not for the occurrence of a data breach, but for the fact that the breach was made possible or facilitated by the absence or inadequacy of security measures implemented by a controller, taking into account the state of the art. In this regard, it has already, on several occasions, found a breach of article 32 of the GDPR, given the absence or inadequacy of the security measures in place, which was exploited by an attacker in the context of a personal data breach (Decision No. SAN-2021-020 of December 28, 2021, § 61; Decision of the Panel of Judges No. SAN-2020-014 of December 7, 2020, § 19; Decision of the Panel of Judges No. SAN-2019-005 of May 28, 2019, § 31; Decision No. SAN-2018-011 of December 19, 2018). 

41. With regard to the assessment of the duty of care incumbent upon the controller, the CJEU holds that the adequacy of such technical and organizational measures must be assessed in two stages. First, it is necessary to identify the risks of personal data breaches arising from the processing in question and their potential consequences for the rights and freedoms of natural persons. This assessment must be conducted in a concrete manner, taking into account the likelihood of the identified risks and their severity. On the other hand, it must be determined whether the measures implemented by the controller are appropriate in light of these risks, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and processing purposes (December 14, 2023, C 340/21, para. 42).

42. Consequently, the Chamber does not intend to penalize the data breach in and of itself, but rather to determine whether, taking into account the state of knowledge, the characteristics of the processing, the likelihood and severity of the risks, as well as the scope of the security obligation specified above, HOPITAL PRIVE DE LA LOIRE has complied with its obligations under Article 32 of the GDPR by implementing appropriate technical and organizational measures.

2. On the risks posed by the processing to data subjects

43. The Chamber of Limited Composition notes that Recital 75 of the GDPR specifies that risks to the rights and freedoms of natural persons—the likelihood and severity of which vary—may result from the processing of personal data that is likely to result in physical, property damage, or emotional distress, in particular: when the processing may lead to discrimination, theft, or identity theft, […] a breach of confidentiality of data protected by professional secrecy […]; when the processing involves […] data concerning health […] when the processing involves personal data relating to vulnerable natural persons, in particular children; or when the processing involves a large volume of personal data and affects a large number of data subjects.

44. Recital 76 of the GDPR states that the likelihood and severity of the risk to the data subject’s rights and freedoms should be determined based on the nature, scope, context, and processing purposes. The risk should be subject to an objective assessment to determine whether the data processing operations pose a risk or a high risk.

45. Furthermore, Recital 83 of the GDPR specifies that, in the context of assessing data security risks, consideration should be given to the risks posed by the processing of personal data, such as destruction, loss, or alteration, the unauthorized disclosure of personal data transmitted, stored, or otherwise processed, or unauthorized access to such data—whether accidental or unlawful—which is likely to result in physical or material damage or emotional distress.

46. In this case, the processing operations related to the hospital’s electronic patient records provide access to a set of data that makes it possible to identify hospital patients very precisely, determine their age, locate them geographically, and contact them—namely, their last name, first name(s), date and place of birth, Social Security number, IPP number, mailing address, email address, and phone number—and to infer that these individuals have received hospital care. It may also contain a copy of the front of their national ID card, which is an official document, as well as particularly detailed health data such as the reason for hospitalization, a list of medical consultations, and, where applicable, information regarding their anesthesia, which are special categories of personal data within the meaning of Article 9(1) of the GDPR. Furthermore, the hospital’s EHR provides access to a set of data concerning individuals designated by patients as trusted third parties, allowing, on the one hand, for their identification, location, and contact (the hospital having indicated that the data typically provided for these individuals includes their last name, first names, mailing address, and phone number) and, second, to determine their family relationship or personal connection to the hospital patient.

48. In 2025, the EHR of the HOPITAL PRIVE DE LA LOIRE contained data on approximately 530,000 patients, in addition to data on approximately 200,000 individuals designated by those patients as trusted third parties.

49. The restricted panel considers that unauthorized access to or disclosure of the data contained in the hospital’s EHR is likely to cause emotional and financial harm to the data subjects. Indeed, these individuals are exposed to risks related to the resale of their data to malicious parties, identity theft, or phishing attempts (a practice involving impersonating an organization known to the data subject in order, for example, to request their bank account information). The unauthorized disclosure of health data can also have serious consequences in people’s lives, including damage to their reputation and integrity, or even lead to risks of discrimination, for example in the areas of employment, housing, or insurance.

50. Furthermore, the panel considers that the likelihood of the risks of unauthorized disclosure of and access to data processed by the hospital materializing is high, given the surge in data breaches over the past several years. Furthermore, the likelihood that risks related to the malicious use of this data will materialize in the event of a breach of confidentiality is also high. As noted by the Public Interest Group Action contre la Cybermalveillance, phishing is the predominant threat in France (Cybermalveillance.gouv.fr Reveals Cyber Threat Trends in France, March 27, 2025).

51. The panel of judges considers that, under these circumstances, the security measures implemented by the HOPITAL PRIVE DE LA LOIRE should have been sufficient to address the risks just outlined.

3. Regarding the level of security deployed by the hospital

52. The National Agency for the Security of Information Systems (hereinafter “ANSSI”) applies the principle of defense in depth to information systems, which consists of basing security not on a single element but on a coherent set of measures. This means, therefore, that in theory there should be no single point on which the entire structure rests, that is to say, any potential security vulnerability in a software component must be offset by at least a second level of security (see the Memento on the concept of defense in depth applied to information systems, version 1.1 dated July 19, 2004). ANSSI bases this concept on the premise that any component of a system can fail or be compromised. This premise, which also applies to the security functions of an IS [information system], is regularly confirmed by news reports on vulnerabilities in numerous products and software programs (see the white paper “Hybrid Information Systems and Security: A Return to Reality,” August 10, 2021).

53. In this case, it is up to the panel to analyze whether the hospital has implemented a coherent set of security measures to protect its information system.

3.1. On the vulnerabilities that led to or facilitated the data breach of June 2025

3.1.1 On the Lack of Security for Remote Access

54. In a digital environment, it is possible for a professional to connect remotely (for example, from home) to their organization’s information system using their laptop. This is known as digital mobility, which ANSSI defines as any form of use of information technology that allows a user to access the information system of their organization or employer from remote locations, donde las ubicaciones no están bajo el control de la entidad (ANSSI, Recomendaciones sobre el nomadismo digital, 2018).

55. In its aforementioned recommendations, ANSSI notes that workplaces not under an organization’s control expose the organization to heightened risks of loss or theft of equipment, compromise of the equipment (for example, during a User’s temporary absence), compromise of the information contained in stolen, lost, or borrowed equipment, unauthorized access to the company’s information system (and thus its compromise), and interception or even alteration of information (loss of confidentiality or integrity).

56. Thus, it emphasizes that in the context of mobile computing, the objective is to align with the entity’s internal information system (IS) security level , by addressing the higher exposure risks listed above, and considers that entities must adopt mobility-specific measures in their information system security policies to reduce or mitigate the aforementioned risks. It specifies that in order to allow a user to access an internal information system from an uncontrolled network, it is necessary to implement a channel that establishes a secure connection between the mobile device and the entity’s internal information system, using VPN (Virtual Private Network) technology. 

58. In the health sector, the security framework governing the electronic identification of users of digital health services—made enforceable by an order of the Ministry of Solidarity and Health dated March 28, 2022— stipulates that when a healthcare professional accesses a digital service from a device connected to the Internet—whether while working remotely, on the go, or even using the facility’s guest Wi-Fi—the connection is considered remote access. (…) Authentication during remote access using a temporary electronic identification method must be based on two different types of factors from among the following three:

- knowledge: for example, a password;

- possession: for example, a fixed device on which the authentication is performed;

- biometrics: for example, a fingerprint stored and verified on a device in the professional’s possession.

59. The guidelines then provide a non-exhaustive list of examples of two-factor authentication mechanisms that ensure a sufficient level of security, namely: a badge containing a contact chip associated with a PIN, a badge containing a contactless chip associated with a password, a USB security key paired with a PIN or a fingerprint stored on the key, or a password paired with a TOTP code (…) generated on a device in the User’s possession, such as a phone or computer for which compatible, freely available applications exist.

60. It also specifies that accessing the VPN via a two-factor electronic identification method exempts the services accessed through that VPN from the requirement for two-factor authentication.

61. In this case, the rapporteur criticizes the hospital for failing to implement appropriate measures to secure access to the EHR for external users, which, at the time of the data breach, was carried out via the internet using a username and password, without a prior connection to a VPN or a two-factor electronic authentication method. She considers that this security deficiency constitutes a breach of Article 32 of the GDPR and made the data breach possible or, at the very least, facilitated its occurrence.

62. In its defense, the hospital does not dispute that remote access to the EHR by external Users was not secured by two-factor authentication at the time of the data breach, but emphasizes that its password policy complied with the recommendations of the CNIL and the ANSSI. The hospital also states that, in consultation with the RAMSAY Group, it had already planned and initiated, prior to the data breach, a process to secure remote access via a platform equipped with a multi-factor authentication solution (the […] platform), the deployment of which was ultimately completed in September 2025. During the hearing, the hospital clarified that in 2024, when the upgrade of the […] software to version […] would have enabled multi-factor authentication, it chose not to deploy it in favor of the solution […] previously selected by the group, which would be deployed at a later date.

63. The hospital also highlights its efforts to modernize and improve its information system, as it is officially participating in the HospiConnect program led by the Digital Health Agency, which aims to meet the objectives of the electronic identification framework, as well as in the Care program.

64. The panel notes that on the date of the data breach, approximately 450 EHR users outside the hospital—namely, private practitioners affiliated with the hospital through practice contracts, their administrative staff, and certain employees of the software publisher […], were remotely accessing the system via a standard internet connection by entering a username and password, without first connecting to a VPN or using two-factor electronic authentication. It notes that version […] of the software […], deployed by the hospital on the day of the data breach, did in fact offer multi-factor authentication, which had not been implemented.

65. The panel thus finds that remote access by external users did not comply with the requirements of the aforementioned standard, since it was not carried out via a VPN or using two-factor electronic authentication.

66. It considers that the lack of multi-factor authentication when these users logged into the hospital’s EHR did not ensure the security of the company’s information system. It emphasizes that, in this case, the attacker exploited this vulnerability to access the hospital’s electronic health records and extract the data they contained. It notes, in fact, that if the hospital had implemented multi-factor authentication for external users to log in to its EHR, the attacker—who had the user account password (knowledge factor)—would also have needed a second authentication factor. The attacker would then have been blocked from accessing the hospital’s EHR if he did not have that second authentication factor.

67. It follows from the foregoing that, given the current state of knowledge, the nature of the processing operations (which involve several hundred thousand pieces of personal data, including health data), and the risks to the rights and freedoms of natural persons, the hospital failed to implement an appropriate level of security.

68. A violation of Article 32 of the GDPR is thus established, as the hospital failed to take the necessary measures to ensure the security of remote access by external Users to the EHR.

69. The Panel notes that since the data breach, the hospital has implemented multi-factor authentication for external Users logging into its EHR, thereby bringing itself into compliance with the regulations previously cited.

3.1.2 Regarding the Inadequate Authorization Policy

70. Pursuant to Article 32 of the GDPR, the controller must implement appropriate measures to ensure the confidentiality of data, and in particular to prevent such data from being unlawfully processed by persons who do not need to know it.

71. The Chamber, in its decision No. SAN-2021-019 of October 29, 2021, thereby reiterated that the management of access rights to view or use an information system must aim to limit access solely to the personal data that a User needs to perform their duties, in particular by defining access profiles within the systems that separate tasks and areas of responsibility. It is therefore the responsibility of the controller to establish—depending on the varying nature of Users’ duties—an access management policy that is appropriate to the significance and sensitivity of the data processed, as well as to the risks to which data subjects are exposed, in accordance with the resources at its disposal.

72. In the healthcare sector, the General Security Policy for Health Information Systems (hereinafter referred to as PGSSI-S), developed by the Digital Health Agency, establishes a reference framework designed to secure e-health practices for professionals and users in the healthcare sector. In particular, the guide for managing access authorizations to the information system emphasizes that the concept of a care team must be taken into account when managing authorizations, in compliance with the law and in accordance with the specific organizational structure of the facility. Taking this into account may be one of the key factors in defining the regulations for organizing and assigning access authorizations to healthcare personnel.

73. This concept of a “care team” is defined by Article L. 1110-12 of the Public Health Code as a group of professionals who directly participate, for the benefit of the same patient, in the performance of a diagnostic, therapeutic procedure, disability compensation, pain relief, or prevention of loss of autonomy, or in actions necessary to coordinate several of these procedures, and who:

- practice in the same healthcare facility, within the Armed Forces Health Service, in the same social or medico-social institution or service referred to in Section I of Article L. 312-1 of the Social Action and Families Code, or within the framework of a cooperative structure, shared practice, or health or medico-social coordination arrangement included on a list established by decree;

- have been recognized as members of the healthcare team by the patient who consults them for the purpose of carrying out consultations and procedures prescribed by a physician to whom the patient has entrusted their care;

- practice as part of a group—comprising at least one healthcare professional—that has a formalized organizational structure and practices consistent with specifications established by an order of the Minister of Health. Article L. 1110-4 of the Public Health Code further provides that healthcare professionals who belong to the same healthcare team may share information concerning the same individual, provided that such information is strictly necessary for the coordination or continuity of care or for the individual’s medical-social and social tracking. Conversely, the confidentiality of this information, which is protected by medical confidentiality, must be ensured with respect to individuals who do not need to know it for the patient’s care.

75. Consequently, the controller of an electronic patient record system must implement a rigorous access authorization policy tailored to the facility’s needs, so that each healthcare professional and facility staff member has access only to the records they need to see. This access control policy must combine two criteria:

- first, the role performed: for example, a staff member responsible for receiving patients at the facility should only have access to the patient’s administrative record and not to medical data, whereas a physician will also have access to medical data;

- second, consideration of the concept of the healthcare team, as defined by Article L. 1110-12 of the Public Health Code, so that only professionals actually involved in a patient’s care or in the treatment provided to them may have access to information covered by medical confidentiality. 

76. The granted authorizations may be supplemented by an “emergency access” mode, defined by the PGSSI-S authentication framework for healthcare providers as the temporary and exceptional assignment of expanded rights in crisis situations, allowing administrative staff and healthcare professionals, in an emergency, to access additional data for any patient. The use of this “emergency access” mode must be meticulously tracked and monitored so that anyone using it can be identified and must justify the circumstances of its use.

77. The rapporteur considers that the hospital’s EHR authorization policy is inadequate in that, while it does distinguish between different job categories and departments—specifying the rights of each user category regarding the various EHR modules (create, view, enter/edit, or administrator), but it does not allow for the segregation of patient records accessible from a single User account. As a result, medical and paramedical practitioners can freely access the records of all patients at the facility, even if they are not involved in their care. She considers that these facts constitute a violation of Article 32 of the GDPR.

78. In its defense, the hospital acknowledges that, as of the date of the data breach, the software […] did not allow access to patient records to be restricted to the healthcare team involved in the care of a given patient. It notes, however, the work undertaken to formalize an authorization matrix that distinguishes between different user profiles based on their job roles and limits their right of access to only those EHR modules necessary for the performance of their duties. It emphasizes the significant technical and organizational challenges involved in changing the EHR management software and notes the efforts already underway to modernize and standardize its hospital information system.

79. The select panel notes that the authorization matrix within the electronic health record system of the HOPITAL PRIVE DE LA LOIRE distinguishes between different categories of job roles and departments based on their nature (for example, physicians, pharmacists, orderlies, or the IT department), and specifies the access rights for each of these user categories regarding the various EHR modules (for example, prescriptions, operating room scheduling, patient transport, and emergency services). It notes, however, that the software does not provide for the segregation of patient records accessible from a single User account, which allows medical and paramedical practitioners to freely access the personal data of all the hospital’s patients (for data contained in the modules to which they have access), even if they were not or are not personally involved in those patients’ care.

80. The restricted panel also observes that the rights authorization matrix, as formalized by the hospital, results in employees of the software publisher responsible for maintaining the EHR being able, in the absence of compartmentalization of patient records, also have access to all of the hospital’s patient records.

81. It thus notes that, while the authorization policy defined by the hospital may meet the first criterion—regarding the type of profession exercised (for example, a physician may access patients’ medical data, whereas reception staff may only access the admissions module)— it is not satisfactory with regard to the second criterion, which relates to the concept of a healthcare team as defined by Article L. 1110-12 of the Public Health Code.

82. It considers that such broad access to the personal data of the hospital’s patients—particularly their health data—is entirely unjustified, and that the hospital’s authorization matrix for access to electronic health records (EHR) is therefore unsatisfactory in light of the provisions of article L. 1110-4 of the aforementioned Public Health Code, and the concept of a healthcare team as defined by article L. 1110-2 of that code.

83. The panel of judges notes that access permissions to the EHR must indeed be configured so that only medical or paramedical professionals actually involved in a patient’s care or in the treatment provided to them have access to information covered by medical confidentiality. These access restrictions may be supplemented by temporary, traceable access authorizations to address emergency situations in which a healthcare professional must intervene even though they are not a member of the healthcare team (for example, in an emergency, via “break-glass” access allowing for the temporary and exceptional granting of expanded rights).

84. It notes that the data protection impact assessment conducted by HOPITAL PRIVE DE LA LOIRE in 2021 had already identified this security flaw—resulting from the lack of segregation of patient records—as the primary threat that could enable unauthorized access to data, particularly in the event of external hacking, internal malice, or internal human error, before concluding that while the severity of the risk was maximal, its likelihood was nevertheless deemed limited.

85. The panel thus finds that the hospital’s failure to fulfill its obligation to ensure the security and confidentiality of data processing is fully established. It emphasizes that this security lapse directly contributed to the scale of the data breach, since by using the login credentials of a physician’s account to access the EHR, the attacker was able—in the absence of compartmentalization of patient records—to access the data of all the hospital’s patients and ultimately extract it. Conversely, if such segregation had been implemented, the data breach would have been limited solely to the records of patients actually treated by the doctor whose credentials had been stolen.

86. Finally, the panel notes that the technical limitations of the software […], which does not provide for the compartmentalization of patient records or a “break-in” mode, do not exonerate the hospital, as the controller is required to select a tool that is state-of-the-art and provides sufficient security safeguards.

87. A violation of Article 32 of the GDPR has therefore occurred, given the hospital’s implementation of an inadequate authorization policy that lacked segregation of patient records.

3.1.3 On the Inadequacy of Traceability Measures

88. In its Decision No. 2021-122 of October 14, 2021, adopting a recommendation on logging, the CNIL reiterates that the implementation of a logging system contributes to compliance with the obligation to secure all processing of personal data, pursuant to articles 5 and 32 of the GDPR.

89. It therefore recommends that organizations collect information about individuals who administer or access their resources—such as the User ID, the date and time of access, and the identifier of the device used—and specifies that this security measure is primarily proactive: it relies on real-time or short-term analysis of this data to detect abnormal operations in order to prevent attacks or intrusions, or to quickly resolve an IT incident by facilitating the identification of the problem.

90. The National Cybersecurity Agency (hereinafter “ANSSI”) notes in its Security Recommendations for the Architecture of a Logging System dated January 28, 2022, that continuous analysis of event logs makes it possible to identify unusual activity, while archiving logs enables doubts to be resolved retrospectively. In this sense, logging is also an essential prerequisite for implementing the ability to detect, analyze, and respond to security incidents.

91. ANSSI lists the categories of events that must be collected to constitute a minimum logging baseline, including, with regard to authentication, logins and successful and failed authentication attempts, and with regard to access to sensitive resources, access or attempted access (read, write, execute, or delete) to sensitive resources.

92. It follows from the foregoing that simply collecting log data is not sufficient to secure an information system. The logging system is, in fact, effective only if an entity is capable of processing the information recorded in the logs so as to be able, if necessary, to quickly detect suspicious behavior.

93. The European Data Protection Board also states in its Guidelines 9/2022 on the notification of personal data breaches under the GDPR that the ability to detect a breach, remedy it, and communicate it as soon as possible should be considered an essential element.

94. In this case, the rapporteur criticizes the hospital for failing to implement any automated analysis of the EHR’s application logs to detect suspicious activity in real time or within a very short timeframe and, if necessary, to trigger an alert mechanism. She notes that this lack of Surveillance allowed the attacker to make an extremely high number of requests within the hospital’s EHR for nearly a week, between June 26 and July 1, 2025, and to extract the data of 524,867 patients, without this abnormal behavior being detected. 

95. In its defense, the hospital partially disputes the characterization of this breach and criticizes the report for failing to account for all of the monitoring measures put in place, namely detection and response software (EDR) on workstations and servers, a security operations center (SOC), a monitoring system based on the […], solution, and a logging system that records application traces. It states that the reason these detection tools did not generate any alerts during the attack was that the load generated by the attacker’s requests did not significantly alter the usual usage threshold.

96. It concedes, however, that at the time of the data breach, there was no automatic real-time analysis of the EHR’s application traces, and states that it has since implemented a number of measures to enable the detection of significant volumetric or behavioral anomalies.

97. The panel notes that at the time of the data breach, the hospital did indeed have IT security threat detection equipment and a security operations center designed to perform data processing using information from, among other sources, network equipment and Active Directory.

98. While it also had a system for logging actions performed by EHR Users (logins, creation, modification, or deletion of data, etc.) for the purpose of storage (these event logs are referred to as “application traces”), it is nevertheless evident from the case file that these logs were not subject to any automated analysis or regular monitoring, and were only reviewed upon request, for example, in the event of a suspected anomaly. The panel thus notes that no measures were in place to detect or report, in real time or in the short term, suspicious activity within the EHR (for example, access that might be fraudulent or unauthorized, or the viewing of an abnormally high volume of patient records).

99. The panel finds that the security measures implemented by the hospital—the existence of which is not disputed—were therefore insufficient to guarantee the security and confidentiality of the data processed.

100. It notes that this lack of surveillance directly contributed to the scale of the breach that occurred, as the attacker was able to make an extremely high number of queries within the hospital’s EHR between June 26 and July 1, 2025, and extract a very large volume of data, without this abnormal user account activity being detected; it was only a user’s report that revealed the data breach.

101. It notes that the post-incident analysis, for its part, made it possible to identify clear signs of abnormal activity on the account, namely, first, a manual reconnaissance phase lasting approximately 12 hours, during which the attacker made 665 requests to understand how the system worked, the site’s directory structure, and to identify the available data; followed by an automated extraction phase, which resulted in the theft of 524,867 patient records over a five-day period—an average of 73 patient records accessed per minute. She emphasizes that while the network activity generated by the attacker was not significant enough to be detected by the traffic analysis tools deployed by the hospital, the implementation of an efficient logging system—with automatic recording and analysis of application traces—could have made it possible to detect, in real time or within a short period, the abnormally high volume of file accesses from the same User account—which was inconsistent with human activity—and to halt the data exfiltration as quickly as possible.

102. The panel thus finds that, given this inadequacy of traceability measures, a breach of Article 32 of the GDPR has occurred.

103. It notes that since the data breach, the hospital has adopted a number of measures to bring its IT system into compliance and to enable the detection of volumetric or behavioral anomalies within its EHR.

3.2. Regarding the Other Vulnerabilities Detected During the Inspection

3.2.1 Regarding the Failure to Maintain Password Confidentiality During the Reset Procedure Following the Data Breach

104. Pursuant to Article 32 of the GDPR, controllers are required to implement a robust authentication policy, which constitutes a basic security measure. When a password is not set by the user but is provided to the user by the controller, the controller must ensure the secure transmission of this personal and confidential information.

105. In its Decision No. 2022-100 of July 21, 2022, adopting a recommendation regarding passwords and other shared secrets —which, while not binding, provides relevant guidance on the security measures that should be taken—the Commission lists a number of precautions to be taken when transmitting a password, in order to ensure that only the User in question is in possession of it. These precautions also apply in the event of a password reset.

106. Consequently, any method of transmitting a password—even a temporary one—that fails to ensure its confidentiality from third parties would not comply with the requirements of Article 32 of the GDPR.

107. The rapporteur considers that the procedure for resetting the passwords of EHR users outside the hospital, implemented following the data breach, was not carried out under conditions that ensured their confidentiality, since it involved assigning an identical temporary password to all practitioners, which, moreover, was not sent directly to them but was communicated to the chair of the hospital’s medical committee, who was responsible for forwarding it to them. It considers that this security lapse constitutes a violation of article 32 of the GDPR.

108. In its defense, the hospital acknowledges having assigned the same temporary password to all external practitioners but emphasizes the urgent nature of this measure, which was intended to stop the ongoing breach without jeopardizing the continuity of care, whereas the software […] did not allow for the automated, individual reset of passwords. It therefore considers that this was the only available technical solution.

109. The panel notes that, following the detection of the data breach, the HOPITAL PRIVE DE LA LOIRE reset the passwords of all EHR users outside the hospital, a procedure that involved replacing their login passwords with a temporary password—the same for everyone—and communicating it to the chair of the hospital’s medical committee, who was responsible for passing it on to them. When users logged into the EHR for the first time using this temporary password, they were prompted to change it to a personal password. Since this temporary password was valid for one week, users who had not logged into the EHR within that time frame to reset their password were instructed to visit the hospital’s IT department in person.

110. The restricted panel observes that by assigning the same temporary password to all EHR users outside the hospital and by providing it to them through the chair of the hospital’s medical committee, the hospital failed to uphold password security, as passwords must be confidential and personal to each User. Moreover, it provided all users with the means to log in to third-party accounts—since they all had the same password for several days—and thereby access all the personal data to which those third parties had access. Consequently, the Panel considers that the transmission of an identical temporary password to all Users—especially through a third party—failed to ensure the confidentiality of the processed data, and that these facts therefore constituted a breach of Article 32 of the GDPR. The Panel notes that this practice demonstrates the hospital’s negligence, even as it was dealing with a data breach that highlighted several security shortcomings.

112. It specifies that any technical limitations of the software used do not constitute grounds for exoneration for the controller, as the latter must ensure that the chosen tool is state-of-the-art and enables the security and confidentiality of the processing to be ensured in accordance with Article 32 of the GDPR.

3.2.2 On the lack of control over the software vendor’s access to the data during processing

113. Since the controller must implement appropriate measures to ensure data confidentiality and prevent such data from being unlawfully processed by persons who do not need to know it (see above, §70), one of the basic precautions must be to limit access to the data to Users who need it to perform their duties, through access rights management.

114. Furthermore, in light of Recital 75 of the GDPR, which clarifies the scope of the aforementioned Article 32, when the processing in question involves special categories of personal data, such as health data, the processing must be subject to enhanced security measures. 

115. In its guide on the secure administration of information systems, ANSSI notes that an entity may engage third parties, such as equipment manufacturers, software vendors, etc. These third parties’ need for access to information systems may be ongoing (for example, under an IT outsourcing contract) or one-time (for example, under a support contract). Access to the entity’s information system—generally remote—therefore poses a major risk of compromise. It is therefore essential to establish a framework governing such access.

116. The rapporteur criticizes the hospital for having granted the software vendor […] permanent remote access to the EHR, and consequently to patients’ personal data, without requiring any action or prior authorization from the hospital. The rapporteur considers that this permanent and unmonitored access to the hospital’s EHR fails to ensure the confidentiality of the processing and thus constitutes a breach of Article 32 of the GDPR.

117. In its defense, the hospital argues that the software publisher’s permanent access is based on the principle of third-party application maintenance, which aims to ensure rapid and effective support. It specifies that permanent access to the EHR via the web application did not apply to all of the software provider’s activities, but only to maintenance tasks; any advanced technical administration actions, meanwhile, required a connection through the company’s bastion server, on which all activity is logged in detail.

118. The hospital adds that since the data breach, corrective measures have been taken to ensure that the software vendor can only connect to the EHR through the bastion server; furthermore, the users’ accounts provided to this service provider are managed by a centralized identity management solution and are automatically deactivated every 180 days.

119. The panel notes that the software vendor has permanent access to the hospital’s EHR, particularly for the purpose of maintaining this IT solution through updates and functional tests. It notes that the audit revealed that the employees of this company responsible for maintaining the hospital’s EHR could initially access it in two ways: either through the […], using a user account specific to each employee, providing access to both the software settings and patient data, or via a bastion server, which provided indirect access to the EHR’s application server and database server, with each employee having a named account on the bastion server.

120. The select panel thus finds that employees of the software publisher […] can access the hospital’s EHR on their own initiative, without having to request prior authorization from the hospital or even notify it.

121. The panel considers that such a prerogative of permanent and unmonitored access to the hospital’s EHR—and, consequently, to patients’ personal data—is not necessary in light of the software publisher’s technical support and maintenance responsibilities. On the contrary, in the event that a maintenance operation had actually required access to the hospital’s EHR, the software publisher’s employees should have systematically sought prior authorization from the hospital.

122. Therefore, the panel of judges finds that by allowing the software publisher […] to access the EHR on its own initiative, without any access restrictions or prior authorization, the hospital granted it rights that exceeded the requirements of its mission and failed to ensure the confidentiality and security of the processed data, which constitutes a breach of article 32 of the GDPR. The panel notes in this regard that the fact that the software company’s employees can now only log into the EHR through a bastion server does not remedy this violation, which concerns the authorization granted to these employees to access EHR data, rather than the security of their remote access. Thus, only technical measures aimed at preventing any access by the software publisher […] to the EHR—unless the hospital removes this technical restriction (for example, manual validation of access to the EHR on the bastion server), could enable the hospital to achieve compliance.

C. Regarding the breach of the obligation to notify data subjects of a personal data breach pursuant to Article 34 of the GDPR

124. Under the law, pursuant to Article 34(1) of the GDPR, when a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person, the controller must notify the data subject of the personal data breach as soon as possible.

125. It is therefore incumbent upon the controller to assess the risk to data subjects and, where appropriate, to notify them.

126. With regard to risk assessment, Guidelines 9/2022 on the notification of personal data breaches under the GDPR, adopted by the European Data Protection Board (hereinafter the EDPB) on March 28, 2023, provide that various factors must be taken into account: the type of breach, the nature, sensitivity, and volume of the personal data, the ease with which data subjects can be identified, the severity of the consequences for the data subjects, the specific characteristics of the data subjects, the specific characteristics of the controller, and the number of data subjects.

127. These guidelines also specify that a risk to the rights and freedoms of individuals exists when a data breach is likely to result in physical or material harm or emotional distress to the individuals whose data has been compromised. Examples of such harm include discrimination, theft, identity theft, financial loss, or damage to one’s reputation. Furthermore, whether or not the controller is aware that personal data is in the possession of individuals whose intentions are unknown or potentially malicious may affect the level of potential risk. Thus, depending on the nature of the breach and the risks it poses, prompt notification will help data subjects take steps to protect themselves against any negative consequences of the breach.

128. Regarding the content of the information to be provided, article 34(2) of the GDPR lists the elements that must be included in such a notification. The notice must include a description of the nature of the personal data breach, its likely consequences, and the measures taken or proposed by the controller to address the personal data breach, including, where applicable, measures to mitigate any potential adverse consequences. Furthermore, it must provide the name and contact details of the data protection officer or another point of contact from whom additional information may be obtained.

129. Recital 86 of the GDPR specifies that this notification must provide recommendations to the data subject to mitigate potential negative effects, since its purpose is to enable data subjects to take the necessary precautions.

130. Finally, the aforementioned Directives 9/2022 reiterate that, in principle, the breach should be communicated directly to the data subjects (…) A notification limited solely to a Press Release or an enterprise blog would not constitute an effective method of communicating a breach to an individual. The EDPS recommends that controllers choose a method that maximizes the likelihood that the information will be properly communicated to all data subjects. Depending on the circumstances, this may require the controller to use multiple communication methods, rather than a single contact channel.

131. The rapporteur considers that the hospital violated Article 34 of the GDPR since only its patients were informed of the data breach, and no direct information was provided to the 202,246 individuals designated by patients as trusted third parties, even though their personal data was also accessed by the attacker when he extracted patient records from the EHR.

132. In its defense, the hospital disputes the alleged violation.

133. First, it highlights the steps taken to contact its patients using different methods tailored to the data that was compromised, including a Press Release on its website, 126,000 personalized emails based on the nature of the compromised data, 210,000 text messages sent to patients whose email addresses were unknown, and 88,000 letters mailed to those for whom neither an email address nor a cell phone number was available.

134. It disputes the report’s characterization of the nature and volume of personal data concerning trusted third parties, stating that this data is fragmentary and is typically limited to last name, first name, phone number, relationship to the patient, and a “trusted” or “not trusted” designation. It also notes that this data is not presented in a structured manner in the data extract provided by the company that developed the “Expert Santé” software, which limits its usability. 

135. The hospital thus argues that, following its risk assessment, it determined that the data breach involving the trusted individuals did not pose a high risk to them and therefore did not require notification under article 34 of the GDPR, given the fragmented nature of the information concerning them, the lack of sensitivity of the data, and the fact that the data subjects were not vulnerable.

136. The panel notes that the hospital contacted its patients through various channels to inform them of the cyberattack (a Press Release on the homepage of its website, emails, text messages, mail), and that the communication provided to these individuals therefore complies with the requirements set forth in Article 34 of the GDPR.

137. It notes, however, that no information was provided to the 202,246 individuals designated as trusted third parties by the hospital’s patients, even though their personal data was also obtained by the attacker as a result of the personal data breach.

138. It specifies that since notification to data subjects affected by a data breach must, in principle, be provided directly, the Press Release posted on the hospital’s website cannot be considered sufficient under Recital 34 of the GDPR. In this regard, it notes that since the individuals designated as trusted third parties were not themselves treated at the hospital, they had even less reason to visit the website on their own initiative.

139. However, the panel of judges considers that the data breach that occurred between June 26 and July 1, 2025, does indeed expose these individuals to significant risks, since the information obtained—in this case, their last names, first names, phone numbers, and their relationship to a patient, can be used for fraudulent purposes, such as in phishing campaigns. Furthermore, the panel emphasizes that this information concerning trusted third parties must be considered in conjunction with that of the patient to whom it is linked in the patient record, and thus constitutes a set of data that could be reused in identity theft schemes, particularly to attempt to complete administrative procedures on behalf of a deceased patient. This risk appears all the more significant given that some patient records obtained by the attacker contain a substantial amount of information, including, in some cases, highly specific health data related to current or past hospitalizations, and, for 46,185 of them, a copy of the front side of the patient’s national ID card.

140. The Panel notes that the hospital was able to quantify and precisely identify the individuals designated as trusted third parties as early as July 7, 2025, the date on which it reported the data breach to the CNIL. Furthermore, if it did not have their email or mailing address, the hospital could have contacted them by sending a text message to their cell phone—a number typically on file—as it did for the patients affected by the breach.

141. It follows from the foregoing that, by failing to inform the 202,246 individuals designated as trusted third parties by patients of the occurrence of a cyberattack that resulted in the fraudulent acquisition of their personal data, the HOPITAL PRIVE DE LA LOIRE breached article 34 of the GDPR.

III. ON CORRECTIVE MEASURES AND THEIR PUBLICATION

142. In law, pursuant to article 20-IV of Law No. 78-17 of January 6, 1978, as amended, when the

controller or its processor fails to comply with the obligations arising from Regulation (EU) 2016/679 of April 27, 2016, or from this law, The President of the National Commission for Information Technology and Civil Liberties may (…) refer the matter to the Commission’s restricted panel for the purpose of imposing, following an adversarial proceeding, one or more of the following measures: (…)

7° Except in cases where the processing is carried out by the State, an administrative fine not exceeding 10 million euros or, in the case of an enterprise, 2 percent of the total worldwide annual revenue for the preceding fiscal year, whichever is higher. In the cases referred to in paragraphs 5 and 6 of article 83 of Regulation (EU) 2016/679 of April 27, 2016, these limits are increased to 20 million euros and 4% of said revenue, respectively. In determining the amount of the fine, the panel of three members shall take into account the criteria specified in the same article 83.

143. Article 83 of the GDPR further provides that each SA shall ensure that administrative fines imposed pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 5, and 6 are, in each case, effective, proportionate, and dissuasive, before specifying the factors to be taken into account when deciding whether to impose an administrative fine and when determining the amount of such a fine.

144. Recital 150 of the GDPR specifies that when administrative fines are imposed on an enterprise, that term must, for this purpose, be understood as an enterprise in accordance with Articles 101 and 102 of the Treaty on the Functioning of the European Union.

145. The Guidelines on the Application and Setting of Administrative Fines for the Purposes of Regulation 2016/679 state that the concept of an “enterprise” should be understood as an economic unit that may consist of the parent company and all relevant subsidiaries. In accordance with EU law and case law, the term “enterprise” should be understood to mean the economic unit engaged in commercial or economic activities, regardless of the legal entity involved.

146. In a judgment of December 5, 2023 (CJEU, Grand Chamber, C-807/21, Deutsche Wohnen), the CJEU held, with regard to the concept of an “enterprise,” that, as the Advocate General noted in point 45 of his Opinion, it is in this specific context of calculating administrative fines imposed for violations referred to in Article 83, paragraphs 4 through 6, of the GDPR that the reference, made in Recital 150 of that Regulation, to the concept of an “enterprise” within the meaning of Articles 101 and 102 TFEU must be understood. In this regard, it should be emphasized that, for the purposes of applying the competition regulations set forth in Articles 101 and 102 TFEU, this concept encompasses any entity engaged in an economic activity, regardless of that entity’s legal status or method of financing. It thus refers to an economic unit even if, from a legal standpoint, that economic unit consists of several natural or legal persons. This economic unit consists of a unified organization of human, tangible, and intangible resources that, on a lasting basis, pursues a specific economic objective (judgment of October 6, 2021, Sumal, C-882/19, EU:C:2021:800, paragraph 41 and the case law cited therein). Thus, it follows from Article 83(4) to (6) of the GDPR, which concerns the calculation of administrative fines for the infringements listed in those paragraphs, that, where the recipient of the administrative fine is or forms part of an enterprise, within the meaning of Articles 101 and 102 TFEU, the maximum amount of the administrative fine is calculated on the basis of a percentage of the total worldwide annual turnover of the concerned enterprise in the preceding financial year. Ultimately, as the Advocate General noted in point 47 of his Opinion, only an administrative fine whose amount is determined on the basis of the actual or material economic capacity of its recipient—and thus imposed by the SA, as regards its amount, on the concept of an economic unit within the meaning of the case law cited in paragraph 56 of this judgment, is capable of satisfying the three conditions set forth in article 83, paragraph 1, of the GDPR, namely that it be effective, proportionate, and dissuasive. Consequently, when a SA decides, pursuant to the powers conferred upon it under Article 58(2) of the GDPR, to impose an administrative fine on a controller that is an enterprise, or forms part of an enterprise, within the meaning of Articles 101 and 102 TFEU, pursuant to Article 83 of that Regulation, that authority is required, by virtue of that provision, read in light of Recital 150 of that Regulation, when calculating administrative fines for the infringements referred to in paragraphs 4 through 6 of Article 83, on the concept of an enterprise, within the meaning of Articles 101 and 102 TFEU (paragraphs 55–59).

147. This position was confirmed by the Court in its judgment of February 13, 2025 (CJEU, Fifth Chamber, C-383/23, Ilva A/S).

148. Finally, the second paragraph of article 22 of the Data Protection Act provides that the panel may make public the measures it adopts.

A. On the Imposition of an Administrative Fine and Its Amount

149. The rapporteur requests that the Chamber in Limited Composition impose an administrative fine on HOPITAL PRIVE DE LA LOIRE for the violations of articles 32 and 34 of the GDPR.

150. In its defense, the hospital considers the amount of the fine proposed by the rapporteur to be disproportionate in light of its financial situation and that of the RAMSAY SANTE group. It highlights the difficulties it has faced and points to the increase in its operating expenses, as well as the significant costs it has already been forced to bear as a result of the data breach, particularly for the services of a cybersecurity firm and for notifying the data subjects. It considers that the panel, in accordance with Article 83(2) of the GDPR, should take into account several mitigating circumstances, such as cooperation with the SA, the measures taken to mitigate the damage, the unintentional nature of the identified violations—which stemmed from the technical and organizational limitations of the legacy software rather than an intent to circumvent the GDPR’s rules—as well as the number of individuals actually exposed to risk and the absence of any direct harm brought to the Commission’s attention. 

151. The hospital also states that the imposition of an administrative fine would correspondingly reduce its ability to implement the security measures recommended by the CNIL and requests, as its primary relief, that no fine be imposed, and, as an alternative, that the amount proposed by the rapporteur be significantly reduced.

1. On the Imposition of the Fine

152. The Panel notes that, in assessing whether to impose a fine, it must take into account the criteria specified in Article 83 of the GDPR, such as the nature, gravity, and duration of the violation; the scope or processing purpose of the processing in question; the number of data subjects affected, the measures taken by the controller to mitigate the harm suffered by the data subjects, whether the violation was committed through negligence, the degree of cooperation with the SA, the categories of data involved, and the level of harm suffered by the data subjects.

153. First, the Chamber considers that the criterion set forth in article 83(a), paragraph 2, of the GDPR, regarding the severity of the breach, taking into account the nature, scope, or processing purpose, as well as the number of individuals affected.

154. With regard to the data security breaches, the panel notes that they affected a significant number of individuals, namely 524,867 hospital patients, as well as 202,246 individuals designated by the patients as trusted third parties.

155. It considers that the significant security deficiencies that were identified enabled or, at the very least, facilitated the breach, as the attacker was able to easily access the hospital’s EHR and extract a substantial volume of data over several days without being detected.

156. It believes that the current surge in cyberattacks requires controllers to pay particular attention to ensuring the security of the data they process. In this regard, it notes that in 2025, the CNIL recorded 6,167 reports of data breaches—the highest number ever—which particularly affected the healthcare, public administration, and financial sectors. It thus emphasizes that the nature of the processing—in this case, the hospital’s electronic health records, which centralize both administrative data enabling the very precise identification and location of individuals and health data, which constitute special categories of personal data within the meaning of Article 9, paragraph 1, of the GDPR, should have led the hospital to exercise particular vigilance when implementing measures to effectively ensure its security and confidentiality, which was not the case. With regard to the breach of the obligation to notify the data subject of a personal data breach, the Panel notes that the hospital failed to notify a significant number of individuals—specifically, 202,246 individuals designated by patients of thethe hospital as trusted third parties, who to date have received no information regarding the nature of the attack and its likely consequences, nor the measures to remedy the situation and protect themselves against any malicious use of their personal data.

158. The panel considers this omission to be particularly harmful given that the volume of information obtained by the attacker, regarding both these individuals and the patients who designated them as trusted third parties, enables sophisticated forms of phishing, or even identity theft, particularly in attempts to carry out administrative procedures on behalf of a minor, a protected adult, or a deceased patient.

159. It follows from the foregoing that the hospital’s gross violations are serious.

160. Second, the panel considers that the criteria set forth in subparagraphs (b) and (d) of article 83, paragraph 2, of the GDPR, regarding whether the breach was committed intentionally or through negligence, and the degree of accountability of the controller, taking into account the technical and organizational measures it did or did not implement pursuant to articles 25 and 32 of the GDPR.

161. The Panel notes that the security measures that would have prevented or mitigated the breach are well established by the state of the art, and that the hospital had the human, technical, and financial resources to implement them.

162. It emphasizes that the vulnerabilities identified following the audit are the result of a failure to implement basic security measures, both technically (by failing to use two-factor authentication or a VPN forremote access to the EHR) as well as organizational (by failing to implement a log analysis system capable of detecting abnormal activity and triggering alerts, and by adopting an inadequate authorization policy). Taken together, these shortcomings compromised the hospital’s information system and exposed it to a significant risk.

163. The panel of judges notes that the hospital was nevertheless aware of the severity of the risk, since the AIPD conducted in 2021 had classified it as “maximum,” specifying that the extreme sensitivity of the data involved in the processing and the potential consequences of data breaches amply justified this level of severity. It was therefore incumbent upon the controller to implement the necessary measures to secure the processing in a manner commensurate with this risk, which it failed to do, and which contributed to the occurrence of the data breach in June–July 2025, as well as to its scale.

165. Consequently, the panel finds that the breaches in question demonstrate clear negligence on the part of the hospital.

166. Third, the panel considers that the criterion set forth in Article 83(2)(g) of the GDPR, concerning the categories of personal data affected by the breach, should be applied.

167. The panel notes that the hospital’s electronic patient record (EPR) contains, in addition to administrative data, copies of official documents—specifically, copies of the front sides of patients’ identification cards—which constitute relatively sensitive personal data, as well as health data, which constitute special categories of personal data within the meaning of Article 9(1) of the GDPR and are subject to enhanced protection. The panel therefore considers that such data should have been given special attention by the controller to ensure its security and confidentiality.

168. Consequently, in light of all these factors and in accordance with the criteria set forth in article 83 of the GDPR, the Panel finds that an administrative fine should be imposed for the violations in question.

2. Regarding the Amount of the Fine

169. In order to determine the amount of the fine to be imposed on the company, it is necessary to take into account the gravity of the violation committed, as evidenced by the foregoing, as well as the compliance measures implemented following the inspections and during the sanctioning proceedings.

170. The Panel first notes that, pursuant to Article 83 of the GDPR, an administrative fine of up to 20 million euros or, in the case of an enterprise, 4% of the total worldwide annual turnover of the preceding fiscal year, whichever is higher, may be imposed.

171. First, the Panel notes that, as detailed in paragraphs 143 through 146, to determine the upper limit of the fine imposed, as well as to ensure that it is effective, dissuasive, and proportionate, it is necessary to apply the concept of“enterprise” in competition law, by virtue of the direct and explicit reference to this concept in Recital 150 of the GDPR as well as in the Guidelines on the Application and Setting of Administrative Fines for the purposes of Regulation 2016/679.

172. The Chamber of Competition notes that in its aforementioned judgment of December 5, 2023, the CJEU reiterates that an enterprise is an economic unit, even if, from a legal standpoint, that economic unit consists of several legal entities. The CJEU specifies that, as in competition law (Court of Cassation, Commercial Chamber, June 7, 2023, Appeal No. 22-10.545; Competition Authority, Decisions No. 21-D-10 of May 3, 2021, and No. 21-D-28 of December 9, 2021), when a subsidiary is wholly owned, directly or indirectly, by its parent company, on the one hand, that parent company may exercise decisive influence over the conduct of that subsidiary (…) and, on the other hand, there is a rebuttable presumption that the parent company does in fact exercise decisive influence over the subsidiary’s conduct (CJEU, September 10, 2009, C-97/08, para. 60). Moreover, while this presumption remains rebuttable, mere assertions to the contrary by the company are not sufficient to reverse the burden of proof in the absence of any supporting evidence (CJEU, November 16, 2000, C-286/98, para. 80).

173. To determine the amount of the proposed fine, and to ensure that it corresponds to the actual economic capacity of the recipient, it is necessary—if the two companies can in fact be regarded as part of the same economic unit—to take into account the parent company’s revenue so that the fine is effective, proportionate, and dissuasive (CJEU, Fifth Chamber, C-383/23, Ilva A/S, paragraphs 22–29). 

174. In this case, the Chamber notes that HOPITAL PRIVE DE LA LOIRE is part of the RAMSAY SANTE group, and that these two entities may be considered part of the same economic unit under the regulations previously cited.

175. With regard to the amount of the fine, which must be proportionate and dissuasive, taking into account the company’s accountability and financial capacity as well as the relevant criteria set forth in article 83 of the GDPR, the panel considers it appropriate to impose an administrative fine of five hundred thousand euros (€500,000) on HOPITAL PRIVE DE LA LOIRE for the violations of Articles 32 and 34 of the GDPR.

B. On the Issuance of an Injunction Accompanied by a Daily Penalty

176. The rapporteur requests that the panel order the HOPITAL PRIVE DE LA LOIRE to comply with the obligations under Article 32 of the GDPR by redefining its authorization policy, demonstrating that it has implemented a system for logging and analyzing application traces, and taking technical measures to ensure that the software vendor […] is granted access to the EHR only with the hospital’s prior authorization. It proposes that this injunction be accompanied by a penalty payment, payable fifteen months after notification of the decision.

177. In its defense, the hospital does not dispute the importance of the measures prescribed, but highlights the corrective actions already implemented, namely securing remote access, improved management of patients’ national ID cards, and work on analyzing log filing systems.

178. Regarding the measures covered by the injunction, the hospital states that they entail a significant restructuring of its information system, which is already scheduled as part of various national security programs. With regard to the measures concerning access authorizations to the EHR, it requests a fifteen-month extension consistent with the HospiConnect program’s timeline. It also requests that the amount of the penalty proposed by the rapporteur be reduced.

179. The panel notes that the hospital has achieved compliance during the proceedings regarding the security of remote access to the EHR. However, it considers it necessary to order the hospital to continue bringing its operations into compliance with the other provisions of Article 32 of the GDPR by updating its authorization policy, adopting the necessary measures to implement a logging system andproactive real-time or short-term analysis of the logs generated by the information system, and by implementing technical measures to prevent the software vendor […] from having permanent access to the EHR, and to ensure that any access is systematically preceded by authorization from the hospital.

C. On the Public Disclosure of the Sanction

180. The rapporteur requests that the panel make its decision public, and that the decision no longer identify the hospital by name after a period of two years from the date of its publication.

181. The hospital opposes this publication, which it believes would cause it significant and disproportionate reputational harm, likely to undermine the trust of patients and practitioners. In the alternative, it requests that, in the event of publication, the hospital be anonymized within a shorter timeframe—a few weeks, or at the very least less than the two years proposed in the report.

182. The panel of judges considers that such a disclosure measure is justified in light of the proven seriousness of the violations in question and the number of data subjects affected, who must be informed.

183. It further considers that this measure appears proportionate since the decision will no longer identify the company by name after a period of two years from the date of its publication.

FOR THESE REASONS

The CNIL’s panel, after deliberation, decides to:

- impose an administrative fine of five hundred thousand euros (€500,000) on the company HOPITAL PRIVE DE LA LOIRE for the violations of articles 32 and 34 of the GDPR;

- issue an order against HOPITAL PRIVE DE LA LOIRE requiring it to bring its processing activities into compliance with the provisions of article 32 of the GDPR, and in particular:

o to implement a system for logging and proactively analyzing, in real time or within a very short timeframe, the logs generated by the information system in order to detect abnormal user behavior and trigger appropriate alerts and responses, within three months, subject to a penalty of one thousand euros (€1,000) per day of delay;

o to update its access authorization policy, taking into account, in particular, the provisions of Articles L. 1110-4 and L. 1110-12 of the Public Health Code relating to the concept of a healthcare team, so that only those with a need to know have access, by default, to the data (and by providing, for emergency cases, a “break-glass” type mechanism), within fifteen months, subject to a penalty of one thousand euros (€1,000) per day of delay;

o to implement technical measures to ensure that the publisher of the Expert Santé software is granted access to the EHR only with the hospital’s prior authorization, within three months, subject to a penalty of one thousand euros (€1,000) per day of delay;

proof of compliance must be submitted to the panel within the aforementioned timeframes;

- to publish its decision on the CNIL website and the Légifrance website, in a form that will no longer allow the company to be identified by name two years after its publication.

The President

This decision may be appealed to the Council of State within two months of its notification.