Enforcement
EN FREE: Insufficient technical and organisational measures to ensure information security
€15,000,000 fine - French Data Protection Authority (CNIL)
Content
The French DPA has imposed a fine of EUR 15,000,000 on FREE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by using an inadequate authentication procedure to connect to their VPN for remote working. Additionally, the controller failed to adequately inform the affected data subjects due to necessary information being missing from the information email.
GDPR Articles: Art. 32 GDPR, Art. 34 GDPR
Industry: Media, Telecoms and Broadcasting