Sanction RGPD French Data Protection Authority (CNIL) — FREE MOBILE : 27,0 M€ (2026)
- Autorité de contrôle
- French Data Protection Authority (CNIL)
- Pays
- France
- Entreprise / secteur
- FREE MOBILE
- Montant de l'amende
- 27,0 M€
- Date de la décision
- 8 janvier 2026
- Fondement juridique
- Art. 5 (1) e), Art. 32
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The French DPA has imposed a fine of EUR 27,000,000 on FREE MOBILE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by using an inadequate authentication procedure to connect to their VPN for remote working. Additionally, the controller failed to adequately inform the affected data subjects due to necessary information being missing from the information email. Lastly, the controller failed to adequately sort data and retain personal data for a limited amount of time.