Sanction RGPD French Data Protection Authority (CNIL) — FREE : 15,0 M€ (2026)
- Autorité de contrôle
- French Data Protection Authority (CNIL)
- Pays
- France
- Entreprise / secteur
- FREE
- Montant de l'amende
- 15,0 M€
- Date de la décision
- 8 janvier 2026
- Fondement juridique
- Art. 32, Art. 34
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The French DPA has imposed a fine of EUR 15,000,000 on FREE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by using an inadequate authentication procedure to connect to their VPN for remote working. Additionally, the controller failed to adequately inform the affected data subjects due to necessary information being missing from the information email.