Spain

ORANGE ESPAÑA VIRTUAL, S.L.

56,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-08-04.

Rank · Sector

#194

of 384 in Media, Telecoms and Broadcasting

Rank · Spain

#224

of 1,121

Rank · All fines

#717

of 3,230

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-08-04
Controller / Processor: ORANGE ESPAÑA VIRTUAL, S.L.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 56,000 on ORANGE ESPAÑA VIRTUAL, S.L. In January 2024, a data subject filed a complaint stating that their mobile phone number had been transferred to SIMYO from another carrier without their consent. A malicious third party had changed the contact email in December 2023 and used SIMYO's telesales service to transfer the phone number to their own account. As the controller had not adequately verified the third party's request, they had no legal basis to process the data subject's data for the portability request. The controller was fined EUR 70,000, but this was reduced by 20 % for immediate payment.

Open original source Links to the regulator's original publication or another source.