出海歐洲 | 2026年GDPR執法風向標（上）：法國CNIL重罰電信巨頭Free Mobile 4200萬歐元

GDPR第32條要求數據控制者和處理者采取適當的技術和組織措施，以確保個人數據的安全水平與風險相適應。CNIL發現，Free Mobile和Free未能實施充分的安全措施，例如VPN認證薄弱和異常行為檢測無效，導致攻擊者能夠入侵其系統並獲取大量用戶數據。CNIL強調，盡管無法完全消除所有風險，但企業必須采取合理措施降低風險發生的可能性並限制其嚴重性。

GDPR第34條規定，當數據泄露可能對數據主體的權利和自由造成高風險時，數據控制者應及時通知數據主體。CNIL指出，Free Mobile和Free向受影響用戶發送的電子郵件通知未能包含GDPR第34條第2款所要求的所有必要信息，導致用戶無法直接了解泄露的後果以及如何采取措施保護自己。

GDPR第5條第1款(e)項規定，個人數據應以允許識別數據主體的時間不超過數據處理目的所需的時間的形式存儲。CNIL發現，Free Mobile在檢查時未能對其前用戶的個人數據進行分類和及時刪除，保留了數百萬條不再需要用於會計目的的數據，超出了合理的保留期限。

GDPR Enforcement Trends in 2026 (Part I): French CNIL Fines Telecom Giant Free Mobile €42 Million

The CNIL’s fine decision was primarily based on the following GDPR violations:

GDPR Article 32 requires data controllers and processors to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The CNIL found that Free Mobile and Free failed to implement adequate security measures, such as weak VPN authentication and ineffective abnormal behavior detection, which allowed attackers to infiltrate their systems and obtain a large amount of user data. The CNIL emphasized that while it is impossible to eliminate all risks, enterprises must take reasonable measures to reduce the likelihood of risks and limit their severity.

GDPR Article 34 stipulates that when a data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller shall communicate the personal data breach to the data subject without undue delay. The CNIL noted that the email notifications sent by Free Mobile and Free to affected users did not contain all the necessary information required by Article 34(2) of the GDPR, preventing users from directly understanding the consequences of the breach and how to take measures to protect themselves.

GDPR Article 5(1)(e) states that personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. The CNIL found that, at the time of the inspection, Free Mobile had not implemented measures to sort and promptly delete the personal data of former subscribers, retaining millions of data records that were no longer needed for accounting purposes, exceeding the reasonable retention period.

The Free Mobile case serves as a significant warning for Chinese-funded enterprises operating in Europe or involved in data exchanges with Europe:

• Increased Compliance Risks: The CNIL’s strict enforcement demonstrates that European data protection authorities have extremely low tolerance for GDPR violations. Chinese-funded enterprises that fail to fully comply with GDPR will face significant fines, reputational damage, and even business disruption risks.

  
  

• Enhanced Emphasis on Data Security: This case highlights the importance of data security measures. Chinese-funded enterprises should review their data security protection systems to ensure they can effectively respond to increasingly complex cyber threats, especially concerning critical aspects such as VPN authentication, intrusion detection, and response mechanisms.

  
  

• Challenges in Data Breach Response Mechanisms: The CNIL’s requirements for the content of Free Mobile’s data breach notification remind Chinese-funded enterprises to establish comprehensive data breach incident response plans, ensuring timely, accurate, and transparent notification to affected data subjects and regulatory authorities in the event of a breach, as required by GDPR.

  
  

• Higher Requirements for Data Lifecycle Management: Free Mobile’s violation of data retention periods reminds Chinese-funded enterprises that they must establish sound data lifecycle management systems, clarifying the collection, use, storage, archiving, and deletion strategies for various types of data to avoid unnecessary long-term data retention.

To cope with the increasingly stringent GDPR enforcement environment, Chinese-funded enterprises should adopt the following compliance measures:

1. Comprehensive Assessment and Strengthening of Data Security Measures: Conduct a comprehensive security audit of existing information systems, especially focusing on remote access, identity authentication, intrusion detection, and response. Invest in advanced security technologies, and regularly conduct security drills and employee training to enhance overall security protection capabilities.

   
   

2. Establish a Sound Data Breach Incident Response Mechanism: Develop a detailed data breach incident response plan, clarifying responsibilities, response processes, and communication strategies. Ensure that in the event of a data breach, it can be promptly identified, contained, remedied, and affected data subjects and regulatory authorities can be notified in a timely and accurate manner, as required by GDPR.

   
   

3. Optimize Data Retention and Deletion Strategies: Review and optimize enterprise data retention policies based on GDPR’s data minimization and storage limitation principles. Set reasonable retention periods for different types of data and establish automated data deletion mechanisms to ensure that data no longer needed is promptly and securely destroyed.

   
   

4. Strengthen Employee GDPR Awareness Training: Regularly conduct GDPR compliance training for employees to make them aware of the importance of data protection, the core principles of GDPR, and the company’s internal data protection policies and procedures. Ensure that all employees comply with GDPR requirements in their daily work.

   
   

5. Seek Professional Legal Advice: Given the complexity of GDPR and evolving enforcement practices, Chinese-funded enterprises should actively seek professional legal and compliance consulting services to ensure that their data processing activities comply with the latest regulatory requirements.

供稿丨廣悅米蘭辦公室

編輯丨吳寶渲

審核丨蘇   冰

審定丨品牌宣傳與市場拓展委