The CNIL has just sentenced Free to a fine of 300,000 euros. Several things are blamed on the access provider.
According Freebox Universe, the operator would not have paid enough attention to the protection of the data of its subscribers, and would have had some problems in the reconditioning of its boxes. Reason why, in addition to the fine, ” the CNIL’s restricted committee issued a compliance injunction in connection with respect for the right of access “.
Clear passwords
After investigation, the National Commission for Computing and Liberties was able to note several problems relating to access to user data, as well as the obligation to erase data in the event of a request. Several requests were therefore not processed in time.
Perhaps even more problematic is the question of passwords unearthed by the CNIL. For the administration, the passwords generated during registration, renewal or recovery were too weak. These passwords were also accessible in clear text. in the company’s subscriber database “, Explain Freebox Universe.
Finally, the independent administrative authority criticized the sending, by mail or e-mail, of these passwords in plain text, without the latter having an expiry date or being accompanied by an obligation to change.
Refurbished freeboxes included data from former users
The other reproach of the CNIL is due to the poor reconditioning of Freebox, because of which several thousand of these devices still containing the data of former subscribers were sent to new customers.
Thus, 4100 of these devices have been ” reallocated to new customers without the data of these former subscribers which would have been stored there having been correctly erased. This data could be photos, personal videos or the recording of television programs “. An incident whose correction by Free has not been properly documented elsewhere, which constituted another breach of duty on the part of the ISP.
Source : Freebox Universe
2