Spain

XFERA MÓVILES, S.A.U.

200,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-08-10.

Rank · Sector

#102

of 383 in Media, Telecoms and Broadcasting

Rank · Spain

#82

of 1,104

Rank · All fines

#397

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-08-10
Controller / Processor: XFERA MÓVILES, S.A.U.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 200,000 on XFERA MÓVILES, S.A.U. In July 2023 an unauthorised third party accessed the telephone line of a data subject. This was achieved by obtaining a duplicate SIM card. In the process the third party showed the controllers agent an ID card that matched the data subject's ID number, name and nationality but not their place and date of birth or address. The manual distributed by XFERA for obtaining SIM card duplicates required full document verification, which the agent failed to fulfil.

Open original source Links to the regulator's original publication or another source.