France Travail
We read the privacy notices published across central government, councils, tax and benefits offices, health bodies and policing. These are the patterns that repeat. A public body is not a company and you are not its customer: it holds your record because a law lets it, which changes what you can ask for and what you can expect back.
Reported incidents
Fined 5 million euros after job seekers' records were taken via adviser accounts
2026-01-29Affected Job seeker files reached through CAP EMPLOI adviser accounts
The CNIL fined France Travail, the French public employment service, 5 million euros, announced on 29 January 2026. In early 2024 attackers used social engineering to take over accounts of CAP EMPLOI advisers, who support disabled job seekers, and reached data on people registered over the past 20 years, including National Insurance numbers, email and postal addresses and phone numbers. The CNIL found weak adviser logins, poor logging and access rights far wider than needed. It noted France Travail had identified the right measures in its own impact assessments and not put them in place.
People affected typically ask France Travail to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.