In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.