The Challenge
Your organization reports a personal data breach to the CNIL. You've met the 72-hour notification requirement under Article 33, informed affected individuals, and documented your incident response. Then, legal claims start arriving.
Here's what catches most compliance teams off guard: the CNIL can investigate, issue corrective measures, and impose administrative fines, but it cannot award damages to individuals. That authority sits with the courts. French courts require three specific elements before granting compensation under Article 82 of the GDPR: a GDPR violation, actual harm, and a demonstrable causal link between the two.
This procedural split creates a dual-track problem. You're managing regulatory compliance on one side and civil liability on the other. They're related but distinct processes, each with different burdens of proof and outcomes.
Legal Framework and Constraints
The French legal framework adds complexity. If you're defending against claims from individuals, you're dealing with the tribunal judiciaire for private entities or the tribunal administratif for public bodies. Each has different procedural requirements, including whether claimants need legal representation.
The evidentiary burden is on the claimant. They must prove you violated the GDPR, for example, by failing to implement appropriate technical and organizational measures under Article 32. They must prove they suffered material or moral harm. And they must prove that harm flowed directly from your violation, not from another event coinciding with your breach.
The key constraint for your defense strategy: controllers operate under a presumption of fault. Article 82 shifts the burden. You can escape liability only if you prove you're "in no way responsible" for the event that caused the damage. That's a high bar. It's not enough to show you had some security measures in place or that you responded quickly. You need to demonstrate the breach occurred despite your full compliance with GDPR obligations.
This means your documentation practices before a breach matter more than your incident response after one. Courts will scrutinize whether you conducted appropriate risk assessments, whether your security measures matched those risks, and whether you can prove both with contemporaneous records.
Strategic Approach
Organizations facing this dual-track exposure can't just rely on breach notification protocols. The CNIL notification satisfies your Article 33 obligation, but it doesn't protect you from civil claims. You need a parallel documentation strategy that anticipates litigation.
Start with your Article 32 implementation records. Can you show, with dated evidence, that you assessed risks to individuals' rights and freedoms? Can you demonstrate you selected technical and organizational measures proportionate to those risks? This isn't about having a security policy document. It's about decision logs, risk registers, and implementation records that show you made specific choices based on specific assessments.
When a breach occurs, your evidence collection needs to serve two masters. For the CNIL, you're documenting the nature of the breach, the categories of data affected, and your mitigation steps. For potential civil claims, you're also preserving evidence that could establish or refute causation. Did the breach lead to fraudulent transactions? Save the transaction logs. Did it result in identity theft attempts? Document the timeline and the mechanisms.
Claimants must prove real harm, not just the existence of a violation. French courts have held that moral harm doesn't require a minimum threshold of severity, but it must be real and personally suffered. This means a claimant can't succeed by pointing to your breach notification and claiming anxiety. They need to show specific consequences: financial loss, reputational damage, loss of control over their data, or documented distress linked to concrete risks.
Your defense requires you to distinguish between the breach itself and the harm claimed. If someone asserts identity theft, you need records showing whether your breach actually exposed the data elements necessary for that type of fraud. If they claim reputational harm, you need to examine whether the breach involved data that was publicly disclosed versus data that remained secured.
Results and Metrics
The source material doesn't provide specific case outcomes or settlement figures, which reflects an important reality: most compensation claims under Article 82 settle before judgment or result in unpublished decisions. What we know is the framework courts apply and the evidence they require.
Organizations that maintain detailed Article 32 implementation records and breach response documentation can defend against claims more effectively than those relying on post-hoc explanations. The ability to prove you weren't "in any way responsible" depends on showing your pre-breach compliance posture, not your post-breach remediation efforts.
Improving Your Compliance Program
The biggest gap in most compliance programs is the disconnect between regulatory compliance documentation and litigation defense preparation. You're probably tracking GDPR obligations for supervisory authority purposes. You might not be tracking them with an eye toward civil discovery.
Consider your data protection impact assessments. Are they detailed enough to show a court that you identified specific risks and implemented specific controls? Or are they checkbox exercises that won't survive cross-examination?
Look at your processor contracts. Article 82 allows individuals to pursue processors directly in some circumstances. If a processor's failure led to a breach, can you demonstrate you conducted adequate due diligence, imposed appropriate contractual obligations, and monitored compliance? Those records become your shield.
Another missed opportunity: claimant evidence requirements. Organizations often assume that once a breach occurs, claims will follow automatically. But Article 82 requires proof of harm and causation. Your breach notification to individuals should be precise about what data was affected and what risks that creates. Overly broad notifications that suggest every possible harm might satisfy transparency obligations, but they also arm claimants with language for their complaints.
Takeaways for Your Team
First, recognize that CNIL proceedings and civil litigation are separate tracks with different objectives. A clean regulatory outcome doesn't prevent civil claims. A CNIL sanction doesn't automatically establish the elements needed for damages.
Second, build your Article 32 documentation with litigation in mind. Risk assessments, control selection rationale, implementation records, and testing results all become evidence. Date them, version them, and preserve them.
Third, when a breach occurs, your evidence collection must serve both regulatory notification and potential civil defense. Document what was exposed, what wasn't, and what specific risks the exposure creates. Vague statements about "potential misuse" don't help your defense.
Fourth, understand the group action risk. French law now provides a unified framework for group actions covering data protection. A single breach affecting multiple individuals can trigger coordinated claims through authorized associations. Your exposure isn't just the sum of individual claims; it's the organizational and reputational cost of defending a collective action.
Finally, don't conflate breach notification with liability management. Notifying individuals under Article 34 is mandatory when a breach is likely to result in high risk to their rights and freedoms. But how you describe that risk, what evidence you preserve, and what your records show about your pre-breach security posture will determine whether those notifications become the foundation for successful compensation claims or defensible positions in court.
The CNIL can't award damages. Courts can. Build your compliance program accordingly.
