A decision from January 2026 by the French data protection authority (CNIL) serves as a timely reminder that overlooking basic data protection measures can result in heavy sanctions. FREE MOBILE and FREE, both part of the Iliad Group, were fined a combined €42 million after a cyberattack exposed personal data linked to more than 24 million subscriber contracts, including bank details and contact information. [1]
What happened?
In October 2024, a malicious actor infiltrated the companies’ systems and gained access to data belonging to millions of subscribers.
The compromised data included IBANs for individuals who were customers of both FREE MOBILE and FREE, raising serious financial and privacy risks.
The attack exploited weaknesses in the companies’ VPN authentication procedures used for remote access, which lacked robust security controls.
CNIL’s subsequent investigation revealed ineffective mechanisms for detecting abnormal activity within the information systems.
The regulator also found that breach notification emails sent to affected individuals did not include all required information under Article 34 of the GDPR, limiting their ability to protect themselves.
Additional deficiencies were identified in data retention practices at FREE MOBILE, which had failed to delete outdated personal data from former subscribers.
Why was this a problem?
The absence of strong authentication procedures left remote access points vulnerable to unauthorised intrusion.
Insufficient monitoring and anomaly detection meant the attack went unnoticed longer than necessary.
Millions of individuals’ personal and financial data were exposed, demonstrating that the security measures in place did not meet the expected standard of “appropriate technical and organisational measures” under Article 32 of the GDPR.
Incomplete breach notifications meant affected individuals could not effectively mitigate potential risks such as fraud or identity theft.
Retaining customer data beyond necessity breached the data minimisation and storage limitation principles of Article 5(1)(e) of the GDPR.
What does it mean for your organisation?
This case underscores that regulators increasingly demand demonstrable evidence of proactive data protection, not just reactive compliance after an incident. Failing to maintain robust authentication, monitoring, and governance frameworks can quickly translate into multi-million-euro penalties, operational disruption, and reputational harm.
To avoid similar pitfalls, organisations must:
Strengthen authentication for remote access: implement multi‑factor authentication (MFA) and limit VPN access to verified devices.
Enhance monitoring and anomaly detection: ensure log analysis and intrusion detection systems can spot and alert on unusual behaviour.
Communicate breaches transparently: notification messages must include all details required by Article 34 GDPR to empower data subjects to act.
Review data retention policies: routinely purge outdated data and maintain documented justification for any retained records.
Conduct regular security audits: verify that basic controls are implemented effectively across all systems.
The takeaway?
The CNIL’s decision shows that even mature telecommunications providers can face severe fines when fundamental safeguards are overlooked. Appropriate security measures are not only best practice, it is a legal necessity.
Tales from the coalface
Each month, we examine Data Protection issues encountered by our clients. This month, we focus on the growing use of biometrics in the workplace and the legal and practical pitfalls that come with it.
Biometric technologies such as fingerprint scanners, facial recognition, or hand geometry readers are increasingly being deployed by employers to monitor attendance and performance, and to control access to buildings or secure sensitive areas. While these systems offer efficiency and security benefits, they also carry heightened privacy risks. Biometric data is inherently personal, unique, and irreplaceable. If compromised, it cannot simply be “reset” like a password.
The fine line between convenience and compliance
Across sectors, there is a growing temptation to introduce biometric controls for convenience or perceived security gains. But collecting and processing biometric data is not a trivial step. Under the UK GDPR and the EU GDPR, biometric data used for identification purposes qualifies as special category data, requiring a lawful basis under Article 6 and an additional condition under Article 9.
Too often, organisations roll out biometric systems without properly establishing whether the processing is necessary, proportionate, or supported by a valid legal ground. Even where consent is claimed, the employer–employee relationship makes it difficult to establish that such consent is truly “freely given”.
What can go wrong?
Lack of a clear lawful basis: Many employers rely on consent for biometric systems, even though employees may feel pressured to agree.
Inadequate transparency: Staff are often not given clear information about how their biometric data is stored, for how long, and who has access.
Weak security measures: Some systems store templates centrally without proper encryption or segregation.
Function creep: Biometric data collected for access control is later used for time tracking or performance monitoring without reassessment.
Absence of impact assessments: Data Protection Impact Assessments (DPIAs) are too often skipped despite being mandatory for such high‑risk processing.
Why does it matter
Processing biometric data without a proper legal framework exposes organisations to significant regulatory and reputational risk. Regulators have made it clear that they expect strict justification for any workplace deployment of such technology. In several recent cases, supervisors have fined companies for excessive or unnecessary use of fingerprint and facial recognition systems where less intrusive methods (for example, badges or PINs) would have sufficed.
How to approach biometrics responsibly
Start with necessity: Assess whether biometrics are genuinely required or if less invasive tools could achieve the same goal.
Carry out a DPIA before implementation: Document risks, mitigations, and the justification for biometric processing.
Avoid reliance on employee consent: Where possible, rely on legitimate interests or compliance with legal obligations, if appropriately assessed.
Be transparent: Clearly explain to staff why biometrics are being used, how their data will be processed, and for how long it will be retained.
Secure the data rigorously: Encrypt biometric templates, ensure separate storage from other HR data, and limit access on a strict need‑to‑know basis.
Plan for lifecycle management: Define when and how biometric data will be deleted, especially when an employee leaves.
Biometrics may be powerful, but misuse can quickly erode employee trust and attract regulatory scrutiny. Treating biometric data with the same level of care as other high‑risk information, and being able to evidence that care, is essential. As technology evolves, so must our understanding of proportionate and lawful use.
If your organisation is considering introducing or reviewing biometric systems, Ambit Compliance can help you assess risks, design compliant workflows, and engage transparently with your workforce. Do not hesitate to contact us at info@ambitcompliance.ie and check further about us on our website https://www.ambitcompliance.ie/.
Contributors to this blog: Gillian Traynor and Facundo Heredia.
