Free – €300,000 Fine (France, 2022)

Between October 2018 and November 2019, the DPA received 41 complaints regarding FREE, a French communications provider (controller), after which the DPA started an investigation based on 10 of these complaints. Some of these complaints concerned access requests for information regarding the data broker from which the controller got personal data. The controller did not respond to these requests in time or provided incomplete answers. According to the controller, the requests were not answered in time due to human error. However, specifically with regard to information regarding the source of the data, the controller stated that it was not obliged to reveal information that was deemed a 'business secret' according to recital 63 and Article 15(4) GDPR (in this case, the identity of the data broker who supplied the data). The controller also stated that it had recently changed its internal procedure, and now asked its data brokers to also provide the identity of the primary source of the data collection, which the controller could then provide to the data subjects. The data subjects also requested the deletion of their e-mail accounts. However, the DPA confirmed that data subject’s personal data was still present in the controller’s database after they had submitted their erasure requests. Also, these e-mail accounts still had the status of ‘active’ and data subjects were still able to access their e-mails. On 8 February 2019, the controller also notified the DPA of a personal data breach. The controller had distributed 4.137 refurbished hardware boxes, called FREE-boxes, to new subscribers. The main use of this FREE-box was to store television programmes, but could also be used to store personal photos and personal video’s. The DPA found that these boxes still contained the personal data of subscribers who had used this hardware previously. The controller did not wipe the data from the device. The controller had accidentally deleted a procedure from its security measures, intended to erase the data stored on the boxes before redistribution. Three years after the breach was reported, 322 boxes were still used by subscribers, without the controller knowing if these boxes contained data of previous subscribers. These boxes were only remotely deactivated by the controller on July 2022, also more than three years after the breach. The DPA determined that the controller violated the following GDPR provisions. Failure to respect the right of access (Articles 12 and 15 GDPR) The DPA determined that the controller violated Articles 12 and 15 GDPR, after the DPA confirmed that the controller did not respond to the data subject’s access requests within one month or had provided incomplete answers regarding the source of personal data. The DPA also stated that the controller’s argument for not disclosing the source of the data because of 'business secrecy' was not valid. The DPA specified that the data subject’s requests were requests for information according to Article 15(1) GDPR. The ‘Business secrecy’ exception only applied to Article 15(4) GDPR, where a data subject would request a copy of their data, which was not the case here. The DPA continued that any processing had to comply with Article 5(1)(a) GDPR, and that personal data had to be processed in a transparent manner. The DPA stated that the data subject’s right of access constituted a fundamental guarantee for the transparency of data processing methods by the controller. When the data subject filed an access request, the controller had to communicate the specific source of the data. The controller was only exempt from this obligation when the controller did not have this information. The fact that the controller had not provided the identity of the data broker despite possessing this information, prevented the data subject to verify the lawfulness of the processing carried out. The right of access regarding the primary source of the data was therefore limited by the controller. Failure to respect the right to erasure The DPA also determined that the controller violated Articles 12 and 17 GDPR. The DPA stated that the erasure requests of the data subjects were clear. The data subjects had also used a dedicated form provided by the controller. However, the personal data of the data subjects was still in the controller’s database after the erasure requests. Also, the controller only answered the erasure requests after approximately three years, which was in violation of Article 12(3) GDPR. The DPA also determined a violation of Article 17(1)(a) GDPR, because data subject's e-mail accounts were still active and the e-mails were still accessible several years after the requests were submitted. Failure to ensure the security of personal data (Article 32 GDPR) The DPA held that the controller violated Article 32 GDPR because of several reasons. Password requirements: When a new user account was created on the controller’s website, the controller generated a random password of eight characters which could only contain one type of character. This generated password was not strong enough according to the DPA. The DPA determined that use of a short or simple password without imposing specific categories of characters and without additional security measures, such as blocking measures, may lead to successful attacks by unauthorised third parties. Storing passwords in clear text: All generated passwords were stored in plain text in the controller’s subscriber database until 23 January 2020. The DPA stated that this allowed any person with access to the controller's customer database to collect the passwords of each subscriber, who could then access the user accounts of these data subjects. Transmitting passwords in clear text: Besides that, the passwords were sent by the controller by e-mail or postal mail, in clear text, to the data subjects who created their account on the website. These passwords were of a permanent nature and without a requirement from the controller that these passwords had to be changed later. The DPA stated that this transmission could allow third parties intercepting transmissions to get unauthorized access to user account, as long as these passwords did not have a limited duration and were not required to be changed when first used. FREE-boxes of former customers: The controller also put FREE-boxes in circulation which contained data of previous subscribers. The DPA stated that technical and organisational measures implemented were also not sufficient here, since the controller had no 'alert procedure' to monitor the actual completion of test sequences before the distribution of the boxes to new subscribers. The lack of such a procedure could also allow unauthorised third parties, the new subscribers, to access personal data of former subscribers. These boxes were also only remotely deactivated by the controller three years after the breach was reported. Failure to comply with the obligation to document a personal data breach (Article 33 GPDR) The DPA also determined a violation of Article 33 GDPR. The documentation provided by the controller did not allow the DPA to assess of all the measures taken by the controller to resolve the data breach caused by the redistribution of the FREE-boxes. Fine After considering several factors, the DPA fined the controller €300,000.