法国CNIL就数据泄露对莫比乌斯罚款百万欧元

Summary of the DecisionOrigin of the caseIn November 2022, the CNIL was notified of a data breach by DEEZER. The company reported that its users' data had been posted on the dark web and that its former processor, MOBIUS SOLUTIONS LTD, whose services it used to carry out personalised advertising campaigns for its customers, was involved. In 2023 and 2024, the CNIL carried out documentary investigations on MOBIUS SOLUTIONS LTD.Key FindingsBreach of the obligation for the processor to delete the data controller's data at the end of the contractual relationship (Article 28.3.g of the GDPR)MOBIUS SOLUTIONS LTD retained a copy of the data of more than 46 million DEEZER users after the end of their contractual relationship, despite its obligation to delete all such data at the end of the contract. This unlawful storage of data led to a risk for the security of individuals' data.Breach of the processor's obligation to comply with the instructions of the controller (Article 29 of the GDPR)MOBIUS SOLUTIONS LTD copied and used DEEZER's data without any instructions from the data controller in order to improve the performance of its own services. No contractual clause authorised to use data for such a purpose without prior instruction from the data controller.Failure to comply with the obligation to keep a record of processing activities (Article 30 of the GDPR)DecisionOn the basis of these investigations, the restricted committee – the CNIL body responsible for imposing sanctions – considered that the company had failed, as a processor, to comply with several obligations under the GDPR.The restricted committee therefore issued a fine of €1 million and decided to make its decision public. The amount of the fine was determined in light of the seriousness of the breaches, the number of people affected by the data breach and the turnover of MOBIUS SOLUTIONS LTD.For further information:[FR]: https://www.cnil.fr/fr/violation-de-donnees-sanction-dun-million-deuros-lencontre-de-la-societe-mobius-solutions-ltd[EN]: https://www.cnil.fr/en/data-breach-mobius-solutions-ltd-fined-eu1-million