# FREE: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: French Data Protection Authority (CNIL)
- Date: 2026-01-08
- Original: https://www.enforcementtracker.com/ETid-2994
- Canonical: https://overview.legal/posts/51505
- Topics: Data Breaches, Access Controls, Security, Telecommunications, Processing Agreement, Controllers, Law Enforcement, Personal Data, Supervisory Authorities, Data Controller

## Summary

The French DPA has imposed a fine of EUR 15,000,000 on FREE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by using an inadequate authentication procedure to connect to their VPN for remote working. Additionally, the controller failed to adequately inform the affected data subjects due to necessary information being missing from the information email.

## Full text

The French DPA has imposed a fine of EUR 15,000,000 on FREE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by using an inadequate authentication procedure to connect to their VPN for remote working. Additionally, the controller failed to adequately inform the affected data subjects due to necessary information being missing from the information email.

GDPR Articles: Art. 32 GDPR, Art. 34 GDPR
Industry: Media, Telecoms and Broadcasting

---
Generated by overview.legal · https://overview.legal/posts/51505 · 2026-08-22