Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Spain: AEPD fines Orange Espagne €70,000 for unlawful processing of personal data

The Spanish data protection authority ('AEPD') published, on 23 March 2023, its decision in Proceeding No. PS-00297-2022, as issued on 31 January 2023, in which it imposed a fine of €70,000 on Orange Espagne, S.A.U., for violations of Article 6(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a complaint submitted by an individual.

Background to the decision

In particular, the AEPD stated that the complainant, a user of a mobile telephone line managed by Orange Espagne, alleged that Orange Espagne had provided a third party with a duplicate of the SIM card of said mobile line, without the consent of the complaiant. In this regard, the AEPD specified that, according to the complainany, as a result of this, said third party had been able to access their electronic banking, making fraudulent bank transfers from the complainant's personal account.

Findings of the AEPD

In light of the above, the AEPD found that Orange Espagne had provided a duplicate SIM card to a third party other than the legitimate owner without their consent and without verifying the third party's identity, the latter then being able to access information via the SIM card, such as bank details, passwords, and email addresses. In this regard, the AEPD held that Orange Espagne breached its duty to protect customer information and failed to take necessary precautions to prevent the incident from occurring, thereby violating Article 6(1) of the GDPR.

Outcomes

As a result, the AEPD imposed a fine of €70,000 on Orange Espagne for the aforementioned violation.

You can read the decision, only available in Spanish, here.

UPDATE (27 March 2023)

AEPD dismisses Orange Espagne's appeal for reconsideration

The AEPD published, on 24 March 2023, its decision in Proceeding No. PS-00297-2022, as issued on 31 January 2023, in which it dismissed Orange Espagne's appeal for reconsideration, lodged on 1 March 2023, as the same had not provided new facts or legal arguments that would have allowed the reconsideration of the contested decision.

You can read the decision, only available in Spanish, here.

Feedback