Data breach: the CNIL fined MOBIUS SOLUTIONS LTD €1 million
Background information
- Date of final decision: 11 December 2025
- National case
- Controller: MOBIUS SOLUTIONS LTD
- Legal Reference: Article 28 (Processor), Article 29 (Processing under the authority of the controller and processor), Article 30 (Records of processing activities)
- Decision: Administrative fine
- Key words: Administrative fine, Data security, Data breach
Summary of the Decision
Origin of the case
In November 2022, the CNIL was notified of a data breach by DEEZER. The company reported that its users' data had been posted on the dark web and that its former processor, MOBIUS SOLUTIONS LTD, whose services it used to carry out personalised advertising campaigns for its customers, was involved. In 2023 and 2024, the CNIL carried out documentary investigations on MOBIUS SOLUTIONS LTD.
Key Findings
- Breach of the obligation for the processor to delete the data controller's data at the end of the contractual relationship (Article 28.3.g of the GDPR)
MOBIUS SOLUTIONS LTD retained a copy of the data of more than 46 million DEEZER users after the end of their contractual relationship, despite its obligation to delete all such data at the end of the contract. This unlawful storage of data led to a risk for the security of individuals' data. - Breach of the processor's obligation to comply with the instructions of the controller (Article 29 of the GDPR)
MOBIUS SOLUTIONS LTD copied and used DEEZER's data without any instructions from the data controller in order to improve the performance of its own services. No contractual clause authorised to use data for such a purpose without prior instruction from the data controller. - Failure to comply with the obligation to keep a record of processing activities (Article 30 of the GDPR)
Decision
On the basis of these investigations, the restricted committee – the CNIL body responsible for imposing sanctions – considered that the company had failed, as a processor, to comply with several obligations under the GDPR.
The restricted committee therefore issued a fine of €1 million and decided to make its decision public. The amount of the fine was determined in light of the seriousness of the breaches, the number of people affected by the data breach and the turnover of MOBIUS SOLUTIONS LTD.
For further information:
[EN]: https://www.cnil.fr/en/data-breach-mobius-solutions-ltd-fined-eu1-million