MOBIUS SOLUTIONS LTD Fined €1 Million for GDPR Violations in DEEZER Data Breach On 11 December 2025, France’s data protection authority, the CNIL, imposed a €1 million fine on MOBIUS SOLUTIONS LTD, the processor behind a 2022 data breach affecting DEEZER users. The penalty stems from multiple GDPR violations, including unlawful data retention, unauthorized use of personal data, and failure to maintain processing records. ### Key Details of the Breach In November 2022, DEEZER reported that 46 million users’ data had been exposed on the dark web, tracing the incident to MOBIUS SOLUTIONS LTD, its former processor for personalized advertising campaigns. Investigations conducted by the CNIL in 2023 and 2024 revealed three major compliance failures: 1. Unlawful Data Retention (Article 28.3.g GDPR) MOBIUS SOLUTIONS LTD retained a copy of DEEZER’s user data after contract termination, despite its obligation to delete it. While the company claimed the data was copied by employees without authorization, the CNIL held it accountable, as the information was stored on a non-production environment alongside other clients’ data, creating security risks. 2. Unauthorized Data Use (Article 29 GDPR) The company copied and used DEEZER’s data without explicit instructions to improve its own advertising platform. MOBIUS SOLUTIONS LTD argued this was within contractual scope, but the CNIL ruled that no clause permitted such use without the controller’s approval. 3. Failure to Maintain Processing Records (Article 30 GDPR) As a processor, MOBIUS SOLUTIONS LTD was required to document its data processing activities but did not comply, violating GDPR transparency obligations. ### Jurisdiction & Fine Justification Though MOBIUS SOLUTIONS LTD is not EU-based, the CNIL asserted jurisdiction under GDPR’s behavioral monitoring provisions, as the company processed DEEZER’s user data for targeted advertising. The €1 million fine reflects the severity of the breaches, the scale of affected individuals (46M+ users), and the company’s financial capacity. The CNIL’s decision was made public, underscoring the enforcement of GDPR compliance for third-party processors, even those operating outside the EU.