Ex-Processor Retains 46M User Records After Contract Ends, Fined €1M
Written by AI from the linked story. Not reviewed by an editor. How this works
Mobius Solutions unlawfully retained and exploited personal data belonging to over 46 million Deezer users after their data processing agreement had concluded, directly violating GDPR Articles 28, 29, and 30. This case highlights a critical blind spot in third-party data governance: organizations often lack mechanisms to verify that processors actually delete or return data once a contract ends. The unauthorized use of retained data to improve Mobius's own services compounded the breach, transforming a retention failure into active misuse. This matters because organizations remain accountable for the data they share with processors, even after the relationship ends, making vendor lifecycle management a core privacy responsibility.
Tactical Insight
Immediate actions
- Audit all current and recently terminated data processor agreements to confirm contractual data deletion or return obligations have been fulfilled.
- Require written confirmation and evidence (e.g., deletion certificates) from processors when contracts expire or are terminated.
Long-term improvements
- Embed enforceable data deletion and audit-right clauses into every Data Processing Agreement (DPA) as standard contractual requirements.
- Maintain a continuously updated Record of Processing Activities (RoPA) that tracks data shared with each processor and its expected lifecycle.
- Establish a formal vendor offboarding procedure that triggers data deletion verification before final contract closure.
Detection & oversight measures
- Conduct periodic third-party audits of processors' data handling practices, particularly around data retention and destruction.
- Implement a vendor risk management program that includes post-contract compliance checks to detect unauthorized data retention.