Following a breach that exposed the health data of nearly 500,000 people, France's data protection authority, the Commission nationale de l'informatique et des libertés, reminded data controllers of their obligations. Data controllers are obligated to inform those whose data has been compromised, the CNIL said, and “ensure the security of the data they process by means proportionate to the risks, and in particular for sensitive data such as health data.” If these obligations are not met, the CNIL said it “could initiate repressive actions.”
Full Story