Spanish Data Protection Authority (AEPD) · 10 March 2021
Xfera Moviles S.A.
Insufficient technical and organisational measures to ensure information security
- Regulator
- Spanish Data Protection Authority (AEPD)
- Decided
- 10 March 2021
- Country
- Spain
- Sector
- Media, Telecoms and Broadcasting
- Regulator’s reference
- Not recorded
- Fino case number
- 2021/ES/158
What happened
The Spanish DPA (AEPD) imposed a fine of €150,000 on Xfera Móviles S.A. (defendant) for infringing Article 17, 32, 5(1)(f) GDPR and Article 21 LSSI. The fine was imposed after investigating two complaints received from the same data subject who indicated that the defendant had not stopped sending marketing messages and that the data subject was able to access third party's personal data through the 'Mi Yoigo' platform.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 5Principles relating to processing of personal data5(1)(f)Read →
- Art. 17Right to erasure (‘right to be forgotten’)Read →
- Art. 32Security of processingRead →
- Data principles
- Data security
- Data subject rights
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2021/ES/158.