Who’s Actually Guarding the Taxpayer Data?

The recent cyber heist involving French taxpayer data isn't just a failure of firewalls. When CNIL investigates these breaches, they aren't looking for a narrative about "sophisticated actors." They are looking for why a specific set of administrative privileges was left open long enough for an intruder to walk out with the crown jewels.

It’s a pattern that costs money. Foreign governments have extracted just over $21.7 billion in fines from US tech firms who thought their architecture was sufficient. The common thread isn't a lack of tools, but a gap between what's written in the policy and what's actually happening in the database.

For the person tasked with implementing controls, this comes down to GDPR Article 32. While many treat this article as a vague suggestion to "be secure," it is the primary lever regulators use to punish firms. A fine under Article 32 isn't really for the breach itself; it’s for the failure to implement "technical and organizational measures" to ensure a level of security appropriate to the risk.

In plain English: you failed to limit access.

If you are providing evidence for an audit, stop handing over your high-level security policy or a PDF that claims you follow 'privacy by design.' I distrust that phrase because it’s usually used as a shield when nothing was actually designed.

Instead, produce the logs.

The only evidence that matters is a timestamped record of who accessed the PII, why they did it, and a proof of when those permissions were revoked. If you can't show that your access reviews happened every 30 days—and that they actually resulted in someone losing access—your "design" is a fiction.

Some will argue that modern AI-driven security layers make manual log reviews obsolete. They’ll say the system automatically detects anomalies.

The Boston AI company breach proves this is a fantasy. Despite being an AI firm, they still managed to expose thousands of Social Security numbers. A fancy detection layer is useless if the underlying storage is a sieve. You cannot automate away the requirement for basic hygiene.

This creates a nasty second-order effect for insurers. We are hitting a point where cyber insurance providers will stop trusting the "compliance certificates" provided by vendors. They'll start demanding raw proof of identity and access management (IAM) before renewing policies. If you can't prove your least-privilege model is functioning, you aren't just a regulatory risk; you're uninsurable.

The real question for any practitioner right now is this: if the regulator asked for a list of every single person who touched taxpayer or customer data in the last 48 hours, could you produce it in ten minutes?

If the answer is "I'd have to ask the IT team to run a report," you've already lost.