France: One in Five French Data Privacy Sanctions in 2025 Tied to Workplace CCTV

The French Data Privacy Agency (CNIL) sanctioned 16 organizations for having implemented CCTV systems in the workplace which were not compliant with French data privacy and GDPR rules. The fines ranged from 5,000 to 100,000€.

On 9 February 2026, the French Data Privacy Agency (CNIL) published its 2025 report. Out of the 83 sanctions pronounced by the CNIL, 16 are related to organizations that implemented CCTV systems in the workplace, which were not compliant with French data privacy and GDPR rules.

This was an opportunity for the CNIL to remind organizations that the permanent video surveillance of employees is only possible in certain circumstances, namely, in case of specific security requirements or to avoid theft. The CNIL does not consider however it is justified to film employees handling cash registers in stores or offices. It is particularly strict with regards recourse to hidden cameras.

Key Action Points for Human Resources and In-House Counsel

Check that all your HR practices, especially the use of CCTV, are GDPR compliant.