The surnames and first names had been deleted, but there was a lot of personal data such as the composition and income of the household, the amounts and types of benefits received, or the medical situation of the recipients…
During a training in March 2021, an external service provider posted a file containing the personal data of more than 10,000 recipients of the CAF (Caisse d’Allocation Familiale) in Gironde, thinking that they were fictitious, reveals this Thursday the investigation cell by Radio France.
“The goal was for him to be able to create exercises on realistic cases”
In total, no less than 181 pieces of data per recipient were revealed, and found accessible to the general public. “These data were put online by a private service provider to whom CAF had asked to train its agents in the handling of statistical processing software, specifies Squaring the Net, an association that defends fundamental freedoms in the digital environment. It is within the framework of this training that the CAF communicated some 10,000 files of beneficiaries to this service provider. The goal was for him to be able to create exercises dealing with realistic cases. This data remained online for a year and a half.
“These exercises could have been carried out with harmless data sets, the service provider himself said that he thought that the data sent was fictitious, adding that he had not requested real data because it was not necessary”, continues La Quadrature du Net. “This data transfer therefore seems to reveal […] a sense of ownership of our personal data by those responsible [de la CAF], who seem to find it normal to transfer them for no reason to private providers. »