The more than 10,000 recipients of the CAF (Family allowance) from Gironde were surprised by an incident that undermined their privacy. Indeed, confidential personal data related to them was put online on the internet by a service provider responsible for training the agents of this fund.
An “accidental” act
The service provider responsible for training CAF agents in Gironde published the confidential personal data of more than 10,000 recipients on the internet, believing that they were “fictitious”.
This data included address, date of birth, household income, amounts and types of benefits received, and other information. The service provider withdrew them following a request from CAF, but it is possible that they were copied before they were withdrawn. This leak could have serious consequences for the beneficiaries concerned and for CAF de Gironde.
Indeed, by publishing this data on the internet, the service provider has endangered the privacy and security of these recipients and has compromised the trust placed in CAF de Gironde to protect this confidential data.
Whose fault is it ?
According to Radio France’s investigation unit, this immoderate act is probably attributable to a poor assessment of the implementation of a new strategy by the service provider in question consisting of outsourcing certain activities.
However, CAF hastened to intervene immediately and asked the supplier concerned to immediately withdraw the disputed data; what was done. Unfortunately, there is reason to fear that it could have been copied before this withdrawal.
Possible sanctions
An internal investigation has been opened by the CAF (Family allowance) of Gironde and a complaint filed against X for invasion of privacy. The CNIL (National Commission for Computing and Liberties) was also alerted in relation to this case, although civil or even criminal administrative sanctions are not excluded given the very sensitive nature of the information involved. Moreover, in order to move towards greater certainty, the CAF (Family allowance) de Gironde will gradually put in place additional measures aimed at preventing any future recurrence and will inform the recipients concerned via a personal letter inviting them to take advantage of a service intended to maintain and/or protect their privacy free of charge.
