France

FREE

15,000,000 €

GDPR enforcement action by French Data Protection Authority (CNIL) on 2026-01-08.

Rank · Sector

#25

of 369 in Media, Telecoms and Broadcasting

Rank · France

#12

of 74

Rank · All fines

#39

of 3,050

Case details

Authority: French Data Protection Authority (CNIL)
Date: 2026-01-08
Controller / Processor: FREE
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 32 GDPR, Art. 34 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The French DPA has imposed a fine of EUR 15,000,000 on FREE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by using an inadequate authentication procedure to connect to their VPN for remote working. Additionally, the controller failed to adequately inform the affected data subjects due to necessary information being missing from the information email.

Open original source Links to the regulator's original publication or another source.