--- title: Record Fine for French Optical Center after Leak of 334,000 Personal Records description: The French National Commission on Informatics and Liberty (Commission Nationale de l'informatique et des libertés or CNIL) has issued a record fine to an optical center after the company failed to secure the personal (and in some cases highly sensitive) data of its customers. image: https://businessinsights.bitdefender.com/hubfs/girl-face-in-glasses.jpg --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) By [**Filip Truta**](https://businessinsights.bitdefender.com/author/filip-truta) / Jun 13, 2018 # Record Fine for French Optical Center after Leak of 334,000 Personal Records Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/record-fine-for-french-optical-center-after-leak-of-334000-personal-records&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/record-fine-for-french-optical-center-after-leak-of-334000-personal-records&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/record-fine-for-french-optical-center-after-leak-of-334000-personal-records&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/record-fine-for-french-optical-center-after-leak-of-334000-personal-records&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/record-fine-for-french-optical-center-after-leak-of-334000-personal-records&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/record-fine-for-french-optical-center-after-leak-of-334000-personal-records&utm_medium=social&utm_source=facebook) The French National Commission on Informatics and Liberty (Commission Nationale de l'informatique et des libertés or CNIL) has issued a record fine to an optical center after the company failed to secure the personal (and in some cases highly sensitive) data of its customers. [Optical Center](https://www.optical-center.fr/), the actual name of the business, produces eyeglasses, contact lenses and sunglasses in addition to offering medical services. According to a notice by the CNIL, the firm reportedly failed to implement the necessary authentication checks that would prevent one customer from viewing the invoice of another customer. The CNIL said customers could access more than 300,000 documents containing personal and financial data of other customers on Optical Center’s website by simply modifying the URL in the address bar. According to [the notice](https://www.cnil.fr/fr/optical-center-sanction-de-250000eu-pour-une-atteinte-la-securite-des-donnees-des-clients-du-site), the invoices contained full names, postal addresses, health data (ophthalmic correction) and some social security numbers, leading CNIL to label the blunder as “critical.” “Given the particular sensitivity of the data that was made freely available, the number of clients impacted and the volume of documents contained in the company's database at the time of the incident (more than 334,000), \[CNIL\] decided to make its decision public,” the commission wrote. The firm was fined 250,000 euros, the biggest penalty of its kind in France, according to the commission. The CNIL also reveals in its post that Optical Center was fined 50,000 euros in 2015 “due to a security defect.” Had Optical Center’s mess up occurred under the EU’s General Data Protection Regulation, the fine would have been a lot greater – up to 4% of the company’s annual revenue, or 20 million euros (whichever highest). According to some estimates, in situations where a business leaks “personally identifiable information” (PII) of its customers on such a scale, the new regulations set in place by the European Parliament can render businesses bankrupt overnight. ### Explore More Topics - [Enterprise Security (743)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (201)](https://businessinsights.bitdefender.com/topic/threat-research) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [SMB Security (170)](https://businessinsights.bitdefender.com/topic/smb-security) - [Ransomware (166)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (137)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (134)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (126)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (124)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (119)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [Threat Intelligence (76)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [IT Compliance & Regulations (71)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (55)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (53)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (46)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (38)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (18)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (9)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (3)](https://businessinsights.bitdefender.com/topic/podcast) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [UK Fines Jump Since GDPR Implementation](https://businessinsights.bitdefender.com/uk-fines-jump-since-gdpr-implementation?hsLang=en-us) ### [NHS Security Systems, Data Protection Questioned after Repeated Patient Record Losses](https://businessinsights.bitdefender.com/nhs-security-systems-data-protection-questioned-after-repeated-patient-record-losses?hsLang=en-us) ### [52% of UK Businesses Risk Hefty Fines under GDPR](https://businessinsights.bitdefender.com/52-of-uk-businesses-risk-hefty-fines-under-gdpr?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ![](https://px.spiceworks.com/px/5rec) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Filip Truta", "url" : "https://businessinsights.bitdefender.com/author/filip-truta" }, "datePublished" : "2018-06-13T08:05:00.000Z", "headline" : "Record Fine for French Optical Center after Leak of 334,000 Personal Records", "image" : [ "https://businessinsights.bitdefender.com/hubfs/girl-face-in-glasses.jpg" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/record-fine-for-french-optical-center-after-leak-of-334000-personal-records", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```