Privacy & Information Security Law Blog: CNIL Fines French Telecom Operator For Data Security Failure

On December 27, 2018, the French Data Protection Authority (the "CNIL") announced that it imposed a fine of €250,000 on French telecom operator Bouygues Telecom for failing to protect the personal data of the customers of its mobile package B&YOU.

Background

On March 2, 2018, the CNIL was informed – by a third party – of the existence of a years-long security vulnerability on Bouygues Telecom's website bouyguestelecom.fr, the end result of which made possible for any person, including bad actors, to access documents containing customers' personal data from several URL addresses with a similar structure. On March 6, 2018, Bouygues Telecom notified the CNIL of the data breach. The company explained that the incident was due to a human mistake: the computer code, which requires user authentication on the company's website, had been deactivated during a test phase but not re-activated once the tests were completed. The company quickly blocked the data from improper