How to Be Convicted by the CNIL
summary
CNIL's developer guide and enforcement activity are reviewed, showing 345 controls in 2022 and 21 sanctions (about a third for security) with fines up to 4% of global turnover or €20M. Concrete failures include misuse of cookies and Google Analytics, unsecured servers leaking ~300,000 records (Slimpay), indefinite data retention at universities, and using scraped images to train AI without consent; recommended fixes are pseudonymisation, no production data in tests, SSH keys, branch-based workflows, dependency monitoring, and conducting Data Protection Impact Assessments and involving DPOs.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:25What is CNIL
- 10:37GDPR and personal data
- 19:59CNIL sanctions and controls
- 25:18GDPR bad practices
- 34:27Development best practices
- 41:26Q&A
related talks
52mDeveloping privacy
36mPrivacy, Consent and Security Within Modern Applications
55mBattle for online privacy
01h 00mPrivacy and GDPR: What all developers should know
32mGDPR Impact
01h 14mNavigating regulatory complexities Enforcing data protection in the field of AI
25mWhen GDPR and CCPA strike
28mGDRP - Sanctions and Industry Standards