Data breach: the CNIL fined MOBIUS SOLUTIONS LTD €1 million
CNIL fines Mobius Solutions Ltd €1 million for GDPR violations after data breach.
The CNIL has fined Mobius Solutions Ltd €1 million for multiple GDPR violations following a data breach reported by Deezer. Mobius Solutions, a former processor for Deezer, unlawfully retained data of over 46 million users after their contract ended and used this data without authorization to improve its own services. These actions constituted breaches of processor obligations under GDPR Articles 28 and 29, as well as Article 30 regarding record-keeping.
AI summary of the linked source. Not reviewed by an editor. How this works
Run MOBIUS SOLUTIONS LTD?
Get an email when a new story names MOBIUS SOLUTIONS LTD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMobius Solutions unlawfully retained and exploited personal data belonging to over 46 million Deezer users after their data processing agreement had concluded, directly violating GDPR Articles 28, 29, and 30. This case highlights a critical blind spot in third-party data governance: organizations often lack mechanisms to verify that processors actually delete or return data once a contract ends. The unauthorized use of retained data to improve Mobius's own services compounded the breach, transforming a retention failure into active misuse. This matters because organizations remain accountable for the data they share with processors, even after the relationship ends, making vendor lifecycle management a core privacy responsibility.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.