Spain: AEPD fines Oliveros Ustrell €6,000 for GDPR violation
The Spanish data protection authority ('AEPD') issued, on 19 March 2020, a resolution ('the Resolution') on proceedings PS/00008/2020, fining Oliveros Ustrell S.L. €6,000 for violation of Article 6(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). In particular, the Resolution outlines that an individual claimant argued that he had received a message from Vodafone España, S.A.U. detailing a purchase made in a physical shop that the individual never carried out. In addition, the Resolution finds that the claimant's Vodafone España online account showed a number portability contract concluded in his name and through his bank details.
Furthermore, the Resolution highlights that Oliveros Ustrell carried out the processing of the claimant's personal data without his consent, in violation of Article 6(1) of the GDPR, incorporating them in its systems without proof of the claimant's consent to the collection. As a consequence, the Resolution imposes on Oliveros Ustrell a fine of €10,000, reduced to €6,000 due to the voluntary payment of the fine.
You can read the Resolution, only available in Spanish, here.