France

FREE MOBILE

27,000,000 €

GDPR enforcement action by French Data Protection Authority (CNIL) on 2026-01-08.

Rank · Sector

#20

of 369 in Media, Telecoms and Broadcasting

Rank · France

of 74

Rank · All fines

#27

of 3,051

Case details

Authority: French Data Protection Authority (CNIL)
Date: 2026-01-08
Controller / Processor: FREE MOBILE
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) e) GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The French DPA has imposed a fine of EUR 27,000,000 on FREE MOBILE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by using an inadequate authentication procedure to connect to their VPN for remote working. Additionally, the controller failed to adequately inform the affected data subjects due to necessary information being missing from the information email. Lastly, the controller failed to adequately sort data and retain personal data for a limited amount of time.

Open original source Links to the regulator's original publication or another source.