Is GDPR Now Optional for Governments?

The French Finance Ministry has had a bit of a wobble. According to the CNIL, taxpayer data has leaked, which is precisely the sort of thing that happens when the gap between a policy document and actual server configuration becomes a canyon. Across the channel, the Metropolitan Police are offering apologies after leaking personal information belonging to alleged victims in cases involving Al Fayed.

It’s a familiar pattern. A government body publishes a glossy page on its website promising "industry-leading" data protection, only for the reality to be discovered by a regulator or a whistleblower. The paperwork usually looks impeccable. The Data Protection Impact Assessments are signed off, the privacy notices are written in perfectly sterile legalese, and the records of processing activities are meticulously maintained.

Yet, the data still gets out.

The problem isn't that the rules are unclear. GDPR is, if nothing else, quite specific about "technical and organisational measures". It doesn't ask for a promise to be careful; it asks for encryption, access controls and a level of oversight that prevents a junior clerk or a flawed API from exposing an entire ministry’s ledger to the wind. When we see these breaches, we aren't seeing a failure of the law, but a failure of implementation.

Then there is the matter of the EU data protection supervisor's recent warnings regarding Europol. The proposed reform and overhaul of the agency risks creating gaps in enforcement. This is where it gets interesting from a regulatory perspective. We have a situation where the state is simultaneously failing to follow existing rules and attempting to rewrite those rules to make them more permissive for its own security apparatus.

Some will argue that national security or the sheer scale of public administration justifies a different standard. They’ll say that Europol cannot operate under the same constraints as a mid-sized bakery in Lyon.

That is a convenient fiction.

If a private firm leaked taxpayer-equivalent data on this scale, they'd be staring at a fine reaching into the tens of millions. When a ministry does it, we get an apology and a promise to "review processes". The rules are not suggestions based on the prestige of the entity holding the data. A breach is a breach because the vulnerability exists in the code or the process, regardless of whether that process is managed by a civil servant or a CEO.

This creates a second-order effect for the rest of us. Whenever a major public body flouts the framework, it sends a signal to every other organisation in the supply chain. If the French Finance Ministry can't secure its data, why should a third-party contractor bother with expensive SOC 2 audits or ISO certifications? The auditors themselves are exposed here; they sign off on controls that are ostensibly "effective", only for those same controls to vanish when the wind blows through a government gateway.

We see this fragility in the private sector too, though usually with more immediate consequences. Trezor recently saw the personal details of just over 13,000 customers leaked—names and home addresses included. In that case, the fallout is clean: a breach notification, some disgruntled users, and potential regulatory scrutiny. There's no "national security" shield to hide behind.

The irony is that the regulators are often toothless when facing their own colleagues in government. The ICO and CNIL can bark, but they rarely bite the hand that feeds their budget.

It leaves one wondering who actually monitors the monitors. We are told that GDPR is the gold standard for privacy, yet it seems to operate as a voluntary guideline for those with enough political capital to ignore it. The paperwork says "protection", but the results say "negligence".

The real test will be whether the EDPB can actually stop the Europol reforms from hollowing out enforcement. If the watchdog is sidelined, GDPR stops being a law and starts being a performance art piece—something we do to look professional while the data continues to flow wherever it pleases.

I'll be watching the next set of CNIL findings on the Finance Ministry. I suspect we'll find that the "technical measures" cited in their compliance filings were nothing more than a PDF stored on an unsecured share drive.