Since 2019, the CNIL has systematically recruited its contractual staff on permanent contracts (CDI)… and this is debatable.
That is the view of the Court of Auditors. It argues that this choice has contributed to a mass expansion of the payroll whose pace is no longer sustainable given the overall state of public finances.
Other elements of HR policy have likewise drawn its attention. For example, a tendency to bypass the pay scales during recruitment. The CNIL places its staff in more favorable categories in this instance. This was the case for at least 10 lawyers – a competency not rare, notes the Court of Auditors – hired on CDI in 2023-2024. They were automatically positioned at the 4th echelon of category A3 even though they had just completed higher education or had less than one year of professional experience.
“CDI = attractiveness”: in the CNIL’s case, the Court of Auditors does not buy the argument
Another topic: the counting of RTT. Each year, the days are credited in advance. A semi-annual decrementing campaign allows the RTT lost due to illness to be recovered. This is not sufficient, says the Court of Auditors. The regulations indeed provide deducting all non-working days, except for special absences for union reasons. In this context, 223 days attributed in 2024 should have been taken into account for the RTT reduction but were not. At the same time, CNIL wrongly chose not to count absences related to parental leave.
The systematic recourse to CDI for contractual staff has been part of the management regulations since 2019. CNIL presents it as an attractiveness argument, the impact of the GDPR having created a competitive market among data protection specialists.
Even if the commission drafts its contracts to allow some flexibility in assigning agents to posts, this practice rigidifies HR management. It also enables agents to take mobility leave of two times 3 years maximum (they can suspend their CDI to work in another structure while retaining a right to return).
The CNIL is already attractive, according to the Court of Auditors. It cites 245 external applications received on average for each of the 50 positions open for recruitment in 2024 and the first half of 2025 (excluding management roles). Moreover, a portion of the posts do not correspond to in-demand skills. The commission accounts for relatively few posts with a technical focus (57, vs 125 with a legal focus).
Payroll: the repro workshop as an example
The payroll accounts for 86% of the CNIL’s budget. This budget rose significantly between 2017 (€17 million) and 2024 (€28.2 million), driven by an increase in the headcount cap (from 195 to 277 FTEs).
Since 2017, the CNIL has occupied a building in Paris where services of the Prime Minister and various independent administrative authorities are grouped. It has kept its own reprography workshop even though a shared workshop “is located just a few tens of metres away,” to borrow the Court of Auditors’ words.
This workshop employs one staff member. It cost €7,800 in 2024 for printing equipment rental, while its activity remains modest (about 50,000 pages per month in 2023). This does not prevent the CNIL from outsourcing printing (€27,500 in 2023, then €15,400 in 2024), justified by short-term needs (before each Thursday morning college) and by producing original formats in-house (posters, cards…). It is not in favor of mutualization for reasons of responsiveness, but also of independence: it must print draft opinions on government texts, or even sanctions against it.
The Court of Auditors notes that the Prime Minister’s services say they are capable of absorbing the CNIL’s volume. It also notes that they already handle printing for other independent administrative authorities and ministerial cabinets, whose documents are no less confidential.
A private travel agency with uncertain added value
The CNIL reimburses travel expenses for commissioners whose family residence and administrative domicile are outside Île-de-France. For some, the Court of Auditors judges the use of taxis at hours that are neither early nor late questionable, given the availability of intercity transport.
Another point that alarms it: the use of the private travel agency available to the Prime Minister’s services. Their DSAF (Directorate of Administrative and Financial Services) receives CNIL requests and enters them into the Chorus-Temporary Travel software. It then accesses the offer and can book instantly, much like a consumer travel platform. The Court of Auditors thus questions the added value of the travel agent, especially since the system is far more costly than direct booking. And the contract with the supplier contains no price schedule or mechanism to control these prices.
The CNIL invited to take inspiration from the Competition Authority
The size of the board – 18 members, which places the CNIL at the forefront among independent administrative authorities – complicates management. It can lead to longer debates and issues of harmonization of knowledge and practices.
With the exception of the president, no member is full-time at the CNIL. In a growth context, this raises questions about their availability to sit. Especially as the need for professionalization in increasingly technical areas grows. The Court of Auditors calls for drawing inspiration from the Competition Authority. Of its 17 members, the board includes 4 vice-presidents who are full-time.
Each year, some commissioners have been paid more for vacations than the number of sessions. The CNIL actually doubled the remuneration for plenary sessions scheduled in the morning but that continued into the afternoon. That is to say, by analogy with other half-day paid activities (European activities, indirect rights exercises). Or, according to the Court of Auditors, this is effectively a single session, with a single minutes and a single presidency. In the current state, doubling the remuneration is not justified.
Agent habilitation: an investigated procedure deemed insufficient
In case of conflict of interest, board members must recuse themselves from sitting. The staff must inform their hierarchical superior, who disbars them.
Disqualifications are tracked in real time in the minutes of the plenary session and the restricted training. But CNIL does not maintain a centralized register of ex ante recusals issued by the HATVP (before nomination of a member, a secretary-general or their deputy), or by the hierarchical superior (before hiring an agent). It also has no monitoring of the origins of recruited agents. This makes it impossible to inventory incoming mobilities that could present a risk of conflict of interest.
The Court of Auditors also notes the habilitation of agents responsible for checks. It regrets that the security inquiry is limited to verifying the absence of a conviction for a criminal offense recorded on bulletin no. 2 of the criminal record.
Requests for opinions: the CNIL at fault on meeting deadlines
The implementation of certain data processing treatments requires prior CNIL referral. It issues a simple, non-binding opinion. The approach concerns exclusively the public sector.
Asked to issue an opinion on a draft law or decree affecting personal data protection, the CNIL has two months to decide (the period can be extended by the presidency). The same timing applies to spontaneous requests for opinion from public authorities. For processing relating to security, safety and crime prevention, the base deadline is eight weeks.
The Commission struggles to meet these deadlines. In 2023, the average processing time was 114 calendar days. In 2024, 75 days.
Over these two years, 55% of requests exceeded the 60-working-days deadline… which is indeed the metric CNIL uses, arguing that it alone matters from the perspective of legal entities. The Court of Auditors counters that this does not comply with the rules. And therefore urges the commission to reform its calculation method.
An incomplete view of the GDPR ecosystem
The channels for disseminating information to the DPAs (data protection officers) are not always clear. Depending on the case, they are informed or not about inspections, complaints or questionnaires addressed to the business directions.
For specific requests, it is difficult for them to obtain a firm CNIL position. As well as a single point of contact (the helpline can, on occasion, provide contradictory responses, notes the Court of Auditors).
Overall, the relationship with the DPAs is characterized by a flow-based logic. CNIL lacks tools to develop a more strategic vision. Its DPAs database is incomplete. It lacks a map of the State’s data processing.
Pre-investigation of complaints: a service contract to renegotiate
Between 2017 and 2024, the annual volume of complaints addressed to the CNIL rose by 113% (the number of admissible complaints increasing by 77%). Notifications of personal data breach also grew similarly (from 2,284 in 2019 to 5,629 in 2024).
At the same time, the number of agents handling complaints rose by 70%. In parallel, the CNIL hired a contractor for pre-investigation (sorting the simplest complaints according to 18 scenario responses). This contractor (one full-time person) processed 3,228 complaints in 2023 and 3,450 in 2024. Flat-rate cost: €168,564 per year, i.e., €49 per complaint in 2024. A properly executed contract, but the Court of Auditors invites renegotiating its content and price when the market is renewed in 2026.
A piecemeal monitoring of complaint processing
Since 2022, the average final response time has stabilized at a little over six months. This remains relatively high, according to the Court of Auditors. Moreover, if you limit to admissible complaints, the average time reached 309 days in 2024.
The activity’s management does not help. The CNIL cannot distinguish, across all complaints, which ones are being processed by the Controls and Sanctions department. It does not count the number of reminders sent to those involved. It also does not document, in its management tool, the reasons for closing a case. It is therefore not possible to reliably analyze the processing of the majority of admissible complaints, in terms of objective, follow-ups and processing times. It is not possible either to know the average processing time for complaints that led to corrective measures or sanctions, due to the separation of complaint and control/sanction activities.
The CNIL president acknowledges the need to intensify steering. She notes that since mid-February, the commission has – at her request – benefited from the support of the DITP (Interministerial Directorate for Public Transformation).
