Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Spain: AEPD fines Orange Espagne €70,000 for unlawful processing of personal data
The Spanish data protection authority ('AEPD') published, on 23 March 2023, its decision in Proceeding No. PS-00297-2022, as issued on 31 January 2023, in which it imposed a fine of €70,000 on Orange Espagne, S.A.U., for violations of Article 6(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a complaint submitted by an individual.
Background to the decision
In particular, the AEPD stated that the complainant, a user of a mobile telephone line managed by Orange Espagne, alleged that Orange Espagne had provided a third party with a duplicate of the SIM card of said mobile line, without the consent of the complaiant. In this regard, the AEPD specified that, according to the complainany, as a result of this, said third party had been able to access their electronic banking, making fraudulent bank transfers from the complainant's personal account.
Findings of the AEPD
In light of the above, the AEPD found that Orange Espagne had provided a duplicate SIM card to a third party other than the legitimate owner without their consent and without verifying the third party's identity, the latter then being able to access information via the SIM card, such as bank details, passwords, and email addresses. In this regard, the AEPD held that Orange Espagne breached its duty to protect customer information and failed to take necessary precautions to prevent the incident from occurring, thereby violating Article 6(1) of the GDPR.
Outcomes
As a result, the AEPD imposed a fine of €70,000 on Orange Espagne for the aforementioned violation.
You can read the decision, only available in Spanish, here.
UPDATE (27 March 2023)
AEPD dismisses Orange Espagne's appeal for reconsideration
The AEPD published, on 24 March 2023, its decision in Proceeding No. PS-00297-2022, as issued on 31 January 2023, in which it dismissed Orange Espagne's appeal for reconsideration, lodged on 1 March 2023, as the same had not provided new facts or legal arguments that would have allowed the reconsideration of the contested decision.
You can read the decision, only available in Spanish, here.