France's data protection authority, the Commission nationale de l'informatique et des libertés, released a report on data protection progress since the enactment of the EU General Data Protection Regulation. The CNIL also addressed GDPR economic impact studies conducted five years after the law's implementation, noting they insufficiently capture benefits for businesses and "welfare gains for individuals."