> worse if the CNIL is warned or if someone steal the zip This is the reason why you should report it immediately. It is no longer about your relationship with

> worse if the CNIL is warned or if someone steal the zip This is the reason why you should report it immediately. It is no longer about your relationship with the CIO. At this point the company itself is at risk and that takes priority. Depending on whether you can tell for sure if anyone downloaded the ZIP the company might still be required to raise this with the CNIL.