Data breach: the CNIL fined MOBIUS SOLUTIONS LTD €1 million
CNIL fines Mobius Solutions Ltd €1 million for GDPR violations after data breach.
Summary
The CNIL has fined Mobius Solutions Ltd €1 million for multiple GDPR violations following a data breach reported by Deezer. Mobius Solutions, a former processor for Deezer, unlawfully retained data of over 46 million users after their contract ended and used this data without authorization to improve its own services. These actions constituted breaches of processor obligations under GDPR Articles 28 and 29, as well as Article 30 regarding record-keeping.
Full text
Data breach: the CNIL fined MOBIUS SOLUTIONS LTD €1 million National News 19 December 2025 fr Background informationDate of final decision: 11 December 2025National caseController: MOBIUS SOLUTIONS LTDLegal Reference: Article 28 (Processor), Article 29 (Processing under the authority of the controller and processor), Article 30 (Records of processing activities)Decision: Administrative fineKey words: Administrative fine, Data security, Data breachSummary of the DecisionOrigin of the caseIn November 2022, the CNIL was notified of a data breach by DEEZER. The company reported that its users' data had been posted on the dark web and that its former processor, MOBIUS SOLUTIONS LTD, whose services it used to carry out personalised advertising campaigns for its customers, was involved. In 2023 and 2024, the CNIL carried out documentary investigations on MOBIUS SOLUTIONS LTD.Key FindingsBreach of the obligation for the processor to delete the data controller's data at the end of the contractual relationship (Article 28.3.g of the GDPR)MOBIUS SOLUTIONS LTD retained a copy of the data of more than 46 million DEEZER users after the end of their contractual relationship, despite its obligation to delete all such data at the end of the contract. This unlawful storage of data led to a risk for the security of individuals' data.Breach of the processor's obligation to comply with the instructions of the controller (Article 29 of the GDPR)MOBIUS SOLUTIONS LTD copied and used DEEZER's data without any instructions from the data controller in order to improve the performance of its own services. No contractual clause authorised to use data for such a purpose without prior instruction from the data controller.Failure to comply with the obligation to keep a record of processing activities (Article 30 of the GDPR)DecisionOn the basis of these investigations, the restricted committee – the CNIL body responsible for imposing sanctions – considered that the company had failed, as a processor, to comply with several obligations under the GDPR.The restricted committee therefore issued a fine of €1 million and decided to make its decision public. The amount of the fine was determined in light of the seriousness of the breaches, the number of people affected by the data breach and the turnover of MOBIUS SOLUTIONS LTD.For further information:[FR]: https://www.cnil.fr/fr/violation-de-donnees-sanction-dun-million-deuros-lencontre-de-la-societe-mobius-solutions-ltd[EN]: https://www.cnil.fr/en/data-breach-mobius-solutions-ltd-fined-eu1-million Relevant topics Personal data breaches Fines Latest news EDPB News Stakeholder event on guidelines on the interplay between data protection and competition law: express your interest30 July 2026 EDPB News Stakeholder event on guidelines on the interplay between data protection and competition law: save the date23 July 2026 EDPB News EDPB calls for legal basis for cross-regulatory information sharing17 July 2026All news