Background information Date of final decision: 11 December 2025 National case Controller: MOBIUS SOLUTIONS LTD Legal Reference: Article 28 (Processor), Article 29 (Processing under the authority of the controller and processor), Article 30 (Records of processing activities) Decision: Administrative fine Key words: Administrative fine, Data security, Data breach Summary of the Decision Origin of the case In November 2022, the CNIL was notified of a data breach by DEEZER. The company reported that its users' data had been posted on the dark web and that its former processor, MOBIUS SOLUTIONS LTD

Background information Date of final decision: 22 December2025 National case Controller: NEXPUBLICA FRANCE Legal Reference: Article 32 (Security of processing) Decision: Administrative fine Key words: Administrative fine, Data security, Data breach Summary of the Decision Origin of the case NEXPUBLICA FRANCE has developed a user relationship management software named PCRM which is used in the field of social action, in particular by departmental houses for the disabled (MDPH). In November 2022, the CNIL was notified of a data breach by NEXPUBLICA FRANCE customers for being able to access

Background information Date of final decision: 13 January 2026 National case Controller: FREE MOBILE and FREE Legal Reference: Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject), Article 5 (Principles relating to processing of personal data) Decision: Administrative fine Key words: Administrative fine, Data security, Data breach Summary of the Decision Origin of the case In October 2024, an attacker managed to infiltrate the companies' information system and access personal data relating to 24 million subscriber contracts, including

Background information Date of final decision: 22 January 2026 National case Controller: FRANCE TRAVAIL Legal Reference: Article 32 (Security of processing) Decision: Administrative fine Key words: Administrative fine, Data security, Data breach Summary of the Decision Origin of the case In the first quarter of 2024, one or more hackers managed to hack into the FRANCE TRAVAIL information system. They used techniques known as "social engineering", which involve exploiting people's trust, ignorance or credulity. This method enabled them to hijack the accounts of CAP EMPLOI advisers, i.e. the

Brussels, 30 July – The EDPB and the European Commission organise a remote stakeholder event in the context of their joint work on upcoming guidelines on the interplay between competition and data protection. The event will take place on 15 October 2026 and is an opportunity for stakeholders to inform and support the ongoing work on this topic. The event reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027. Who can participate? The EDPB and the European Commission welcome

Brussels, 23 July – The EDPB and the European Commission organise a remote stakeholder event in the context of their joint work on upcoming guidelines on the interplay between competition and data protection. The event will take place on 15 October 2026 and is an opportunity for stakeholders to inform and support the ongoing work on this topic. The event reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027. Join the event to have your say This is your chance to contribute directly to

Dublin, 17 July– At a high-level meeting in Dublin on 16 and 17 July 2026, the European Data Protection Board (EDPB) called for a clear legal basis for the sharing of information among regulators with different competences. The Board also discussed how to further expand efforts to support a consistent application of the General Data Protection Regulation (GDPR), including through more intense cooperation between Data Protection Authorities (DPAs). A clear legal basis for efficient cross-regulatory cooperation The Board underlines the growing need in the current regulatory environment for

Brussels, 14 July–The EDPB has published its binding decision of 28 May 2026 under Art.65(1)(a) GDPR*. The decision concerns a dispute submitted by the Belgian Data Protection Authority (DPA) about a complaint against Vlaamse Radio-en Televisieomroeporganisatie (VRT) – a public broadcasting company based in Belgium. The complaint was lodged with the Austrian DPA by the Austrian-based NGO Noyb on behalf of an individual. It concerns the use of cookie banners on the website of VRT . The Belgian DPA, acting as Lead Supervisory Authority (LSA), submitted a draft decision proposing to dismiss the

Brussels, 8 July– During its latest plenary, the EDPB has adopted guidelines on anonymisation and guidelines on web scraping in the context of generative AI. In addition, the Board has adopted the final version of its guidelines on the processing of personal data through blockchain technologies. Understanding anonymous data The new EDPB guidelines bring clarity to the notion of anonymous data, taking also into account the ruling of the Court of Justice of the EU in the case C-413/23 P EDPS v SRB of 4 September 2025 and other CJEU jurisprudence. The guidelines mark a significant milestone in