Details:
| Summary | The Spanish DPA (AEPD) has imposed a fine of EUR 75,000 on Telefonica de España, S.A.U.. A data subject had filed a complaint with the AEPD against the telecommunications company. The controller had booked a service for the data subject without the data subject having concluded a contract for it. After the data subject had accordingly not made any payments for this service, the service was canceled in the same year and a collection agency was commissioned to collect allegedly outstanding debts. The AEPD determined that neither the data processing for the service booking nor the transfer of the data subject’s personal data to the collection agency had taken place lawfully. The original fine of EUR 75,000 was reduced to EUR 45,000 due to immediate payment and admission of responsibility. |
| Link: | link |
| Related articles: | Art. 6 GDPR |
| Type: | Insufficient legal basis for data processing |
| Fine: | EUR 45,000 |
| Sector | Media, Telecoms and Broadcasting |
All data is based on The CMS’s Law GDPR Enforcement Tracker Source: https://www.enforcementtracker.com/