AEPD (Spain) - EXP202305035

AEPD - EXP202305035
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 32 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	27.02.2023
Decided:
Published:	30.03.2026
Fine:	230,000 EUR
Parties:	Orange Espagne S.A.U.
National Case Number/Name:	EXP202305035
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	ap

The DPA fined a telecommunications company €230,000 for issuing a duplicate eSIM card to a third party without the data subject’s consent.

English Summary

Facts

Orange Espagne S.A.U. (the controller) is a telecommunications company. In 2023, a third person made several attempts to request a duplicate of a data subject’s eSIM. According to the controller, the third person was able to circumvent its security policy by knowing the data subject’s information, but failed to activate the eSIM as they did not answer the controller’s random questions correctly. The third person, however, was able to change the email address associated with the eSIM. The controller noted that the third person also used a manipulated copy of the data subject’s ID with a different picture, and the controller issued an internal warning regarding the data subject’s identity theft. Nonetheless, the third person was able to later request a new eSIM duplicate and activate it.

The data subject brought a complaint to the DPA, after receiving notifications from their bank regarding fraudulent transactions, and losing phone coverage. The data subject stated that the controller did not inform them of the failed eSIM duplication requests, or of the internal warning on identity theft. The controller argued that there was a pending criminal investigation relating to the case, and that the DPA could not investigate the criminal proceedings were closed in accordance with national law. In addition, the controller argued that its security policy prevented several attempts to duplicate the data subject’s eSIM.

Holding

The DPA first dismissed the controller’s argument regarding the pending criminal investigation. The DPA stated that the two cases involved different parties being investigated (the controller for the DPA, the third person for the criminal case), and that the scope was different. Therefore, there was no need for the DPA to wait for the outcome of the criminal proceedings.

The DPA found a violation of Article 32 GDPR, as the controller failed to ensure security of processing. The DPA noted that the controller issued an internal warning after detecting a case of identity theft. This, however, did not prevent an employee from later issuing a duplicate eSIM. Therefore, the measures were not effective. The DPA emphasised that this was not an isolated incident, but rather a general weakness in the controller’s security policy.

The DPA fined the controller €230,000, and ordered the controller to ensure that its processing activities complied with the requirements under Article 32 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/54

• File No.: EXP202305035

RESOLUTION OF SANCTIONING PROCEEDINGS

From the proceedings initiated by the Spanish Data Protection Agency and based on the following:

BACKGROUND

FIRST: Complaint to the AEPD

A.A.A. (hereinafter, the complainant) filed a complaint with the Spanish Data Protection Agency on February 27, 2023. The complaint is directed against ORANGE ESPAGNE, S.A.U., with Tax Identification Number A82009812 (hereinafter, the respondent, Jazztel, or Orange), ***COMPANY.1 with Tax Identification Number ***NIF.1, and ***COMPANY.2 with Tax Identification Number ***NIF.2. The grounds for the claim are as follows:

The claimant, through their representative, states that they have a mobile phone and internet service contract with Jazztel (the defendant's brand) and indicates that on February 4, 2023, an attempt was made to duplicate their phone number, ***TELÉFONO.1, and to change their email address without their knowledge.

They also state that on February 7, 2023, several bank transfers were fraudulently made without their consent from an account on which they are authorized, for a total of (…) euros.

Furthermore, they state that on February 10, 2023, Jazztel opened an internal incident report, which was not communicated to them, documenting the attempted duplication of their SIM card. He states that in said incident,

Jazztel indicated that it should not process any request related to the card number.

He adds that on February 11, 2023, another attempt was made to duplicate his card at a Jazztel point of sale, which, according to the company, was not processed.

On that same date, he states that he went to an Orange store to request a duplicate card, since his phone had no coverage.

Furthermore, he notes that on February 13, 2023, a third attempt was made to duplicate his card, which, according to Jazztel, was also not processed. However, he states

that on that same day, a duplicate eSIM was processed through the customer area,

referring to the email address that had been fraudulently changed, and
that on that same date, several fraudulent bank transfers were made from his account number for a total amount of (…) euros.

And, that on February 14, 2023, he received communications from his two banks -***COMPANY.1 and ***COMPANY.2- warning of irregularities related to

the fraudulent transfers.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 2/54

Therefore, he believes that there has been a breach of his personal data by the three parties involved.

And, he attaches the following relevant documentation:

1. Table of fraudulent bank transactions.

2. Jazztel telephone and internet service contract.

3. Emails exchanged with your financial institutions, and complaints filed against them.

4. Complaint against Jazztel regarding irregularities that occurred with your mobile phone SIM card: specifically, the change of email address and the duplicate eSIM from the customer area carried out on February 13, 2023; and the theft of money totaling (…) euros.

7. Report filed with the National Police, Zaragoza-Centro branch, dated February 17, 2023, denouncing the events that occurred on February 7, 2023.
8. Report filed with the National Police, Zaragoza-Centro branch, dated February 20, 2023, stating the account holder's name and the charges made to that account.

SECOND: Transfer of the Complaint

In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on

Personal Data Protection and Guarantee of Digital Rights (hereinafter,
LOPDGDD), the complaint was transferred to Orange so that it could analyze it and inform this Agency, within one month, of the actions taken to comply with the requirements of data protection regulations.

The transfer, which was carried out in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was received on April 25, 2023, as evidenced by the acknowledgment of receipt included in the file.

On May 25, 2023, this Agency received a written response

stating:

<<FIRST. – The claimant's claim, as stated in Annex I, is to determine the alleged "joint responsibility" of JAZZTEL, ***COMPANY.1, and
***COMPANY.2 in the "theft of funds from bank accounts in which the

claimant is an authorized user or account holder." These thefts, as stated in the claim and attached documentation, began on February 7,
2023, days before the usurper obtained the activation of a duplicate eSIM on February 13, 2023, by impersonating the account holder, using the modus operandi that will be explained throughout this document. This duplicate was immediately

detected, canceled, and blocked by the Risk Analysis, Fraud, and Fraud Prevention Department, and the IMEI was also blocked. The above, along with the implementation of the other measures outlined in this document, both
with respect to the case at hand and to prevent similar situations.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/54

On the other hand, regarding the options available to customers for requesting a
duplicate SIM card from Jazztel—which, as is known, is one of the telecommunications service brands under which ORANGE ESPAÑA SAU operates—it should be noted

that this is a service to cancel or deactivate the customer's existing SIM card
in order to obtain a new one while maintaining the same number, tariff, and conditions.
The application methods are as follows, as detailed on the following website:

We answer your questions about your SIM - Jazztel Help

• (…).

Furthermore, regarding the eSIM or virtual SIM card, and as also stated on the following website:

Everything you need to know about eSIM cards - Jazztel Help, the current application methods are as follows:
• (…)

In any case, it should be noted that requesting a duplicate SIM card or eSIM is not the same as requesting its activation. The procedure for

activating the eSIM involves scanning a QR code from the mobile device. Once the identity verification process is complete, the customer chooses how they want to receive the information to access the QR code that must be scanned on the device, selecting between an email, an SMS, or both. This SMS contains a link to the Customer's "Private Area," where they must log in with their

credentials to access the QR code. Once the QR code scan is successfully completed, the eSIM will be activated, and consequently, the physical eSIM will be deactivated.

(…)

SECOND. - Regarding the facts described in the complaint and the measures and decisions taken by this company: It is hereby reported that, as soon as this company received the present complaint and request for information, the relevant checks were carried out, leading to the following conclusions, which are reported in the following points:

(…)

At that time, from the aforementioned point of sale in Madrid, following the established protocol, immediate and direct communication was made to the Risk Analysis, Fraud, and Fraud Prevention Department, which immediately reviewed the case and confirmed that it was a manipulated ID card, informing them not to process the application.

Furthermore, in accordance with the established Protocol, as previously stated,
the aforementioned Department reviewed the possibility of other attempts at irregular duplicates,

detecting the following: i) on the one hand, that there had been a previous request
for a duplicate eSIM via telephone a few days prior, which was pending
validation by the system for sending the aforementioned QR Code, so the aforementioned
Department immediately informed the requester not to process it. Although it was not possible

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 4/54

to activate the duplicate eSIM, the imposter, by impersonating the holder,
using their manipulated ID card and personal information, and
bypassing the established Security Policy, managed to change the

contact email address.



Regarding this possibility of changing the email address, it is generally reported that, in order for a customer to change their email address or contact phone number, they must first identify themselves with their personal information: their name, surname, and national identity document (DNI). Additionally, their identity is authenticated according to the established security policy.

Specifically, regarding the aforementioned modification, it has been verified that it was requested during the aforementioned phone call by the imposter. The record shows that the agent, after validating the personal data and the security policy by asking a series of confidential questions, did not detect any irregularities and proceeded to change the address.

However, the imposter did NOT obtain the aforementioned duplicate eSIM because he failed the token security policy. Initially, he told the agent he had "left the card somewhere else," attempting to persuade him otherwise, which was unsuccessful.

Finally, to resolve the issue, he decided to use the confidential random security questions. These questions, however, remained pending validation and were not processed, ending the call.

As explained, this duplicate request was never activated, as it was

permanently canceled. On February 10, 2023, the Madrid point of sale, where the imposter had gone with the manipulated ID to request a SIM, reported the incident to the Risk Analysis, Fraud, and Fraud Prevention Department, which detected the fraudulent request.

ii) On the other hand, the analysis by the aforementioned Fraud Department detected
another attempt to duplicate a SIM card, also via telephone, which was also unsuccessful
due to the effectiveness of the established security protocols.

In this case, it is recorded that the applicant (imposter) contacted the system impersonating
the account holder, claiming that his phone was broken and he needed a

duplicate SIM card. The agent asked for his ID number and personal information; however, he failed to pass the security check. He was then asked to pass the security check using a token, but the agent (changing his
speech) stated that his phone was broken and he needed the duplicate, trying to persuade the agent. The agent then instructed him that, for security reasons, he

had to go to a store.

Having said that, and returning to the account of events at hand, it is reported that, on the same date, February 10, 2023, the Risk Analysis, Fraud and Fraud Prevention Department (...)


It has been established that, having detected the attempted fraudulent duplication, from February 10, 2023, attempts were made to contact the account holder to inform them of the attempted duplication and the actions taken as a result, but these were unsuccessful. Attempts were made again on the following days until, as the complainant acknowledges, they were finally able to contact their partner on February 14, 2023.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 5/54

(…) In this regard, point 6 of the complaint states that they did not have coverage and that they went to a physical store to request a physical duplicate of the SIM card, which was processed, and they acknowledge that it worked correctly from that day forward. (…)


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 5/54 4. On February 14, 2023, this company managed to contact the account holder's partner, who confirmed that they had not requested an eSIM, that the account holder was experiencing coverage issues with the SIM card, and, after the agent warned them about the potential for identity theft and other consequences, confirmed that they had no information on any bank transactions.

During this call, the agent informed them that the fraudulent transactions had been detected and that all necessary measures had been taken immediately and directly. They were also asked to reset their access codes for security reasons and were instructed to submit a police report.

(...)

In other words, the report states that the affected party, despite having received the aforementioned communications, declared that they did not notice anything until "everything reported happened," that is, until the bank withdrawals unfortunately occurred. However, as has been demonstrated by this party, the established precautions and protocols regarding informing the affected party were followed, although due to

external circumstances, this was not achieved until February 14, 2023.

5. The bank transfers claimed, which the client is unaware of, began
before the activation of the duplicate eSIM card on February 13,
2023, which, it is reiterated, was immediately detected internally and blocked by the

Risk Analysis, Fraud, and Presumption of Fraud Department. This is
as stated in the claim and attached documentation. The imposter previously had
in his possession the affected party's ID card, which he altered with another photograph with the intention
of carrying out fraudulent transactions, making this company yet another victim of his
tricks and social engineering. It can be concluded that there is no causal relationship
between the aforementioned duplicate eSIM of February 13, 2023, and the bank transfers

of February 7, 2023, and February 13, 2023.

(…)

Therefore, the robustness and effectiveness of the

identification and security protocols are demonstrated, since the imposter attempted to request and
activate duplicate cards on several occasions previously, but failed to
pass identity verification and comply with the security policy;

Of particular note is the diligent action of the agent at the Jazztel point of sale in Madrid on February 10, 2023, who, in accordance with the established protocol, alerted the Risk Analysis, Fraud, and Fraud Prevention Department. This department acted swiftly, immediately, and diligently, in accordance with the established protocol, both in detecting the attempted fraudulent impersonation using a manipulated ID card and in taking all necessary measures.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/54

deployed in accordance with the established protocol for cases of identity theft.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/54 (…)

However, as previously reported, immediately after its activation, it was detected internally through impersonation alerts. The measures outlined in the previous conclusions were taken, and an attempt was made to contact the affected party to alert them of the situation. Communication was impossible due to circumstances beyond this company's control.

It was not until February 14, 2023, that contact was made with the customer's partner, who stated that they had no record of either the SIM card request or the bank transfers that had been made (according to the attached documentation) on February 7 and 13, 2023. In this regard, it is reported that due to the nature of these types of commercial transactions involving requests for

duplicate SIM cards or changes to contact information, the protocols established for customer service, especially for frontline staff, are very strict and require formal procedures.

Thus, the factual account and the documentation contained in the file and submitted allow us to conclude that Jazztel carried out lawful data processing with a full appearance of legality, in accordance with the established protocols and regulations. current procedure. Once the impersonator managed to bypass identification, since they possessed the ID card of the account holder, which they manipulated in the photograph, and given the security policy, the fraud was detected internally. Effective and diligent measures were deployed, which were also interoperable with the other departments, including communication to points of sale in Madrid to prevent similar cases.

Furthermore, it was concluded that there was no causal relationship between the irregularities related to the SIM card (the duplicate eSIM was activated on February 13, 2023, and immediately deactivated and blocked by Fraud) and the transfers between February 7 and 13, 2023.

As indicated, the identity thief possessed the necessary personal data of the legitimate account holder, including their ID card, which they manipulated. They were already aware of the affected person's personal data, which they did not access. through

this company, but rather had them. Finally, it is reported that although
Jazztel establishes security measures and subjects them to continuous review and improvement, it is
inevitable that individuals, as owners of their data, have a certain
responsibility to keep their access credentials, their
ID card, and other personal information confidential—as well as to review notifications about

possible transactions that they may be unaware of or that may alarm them—without providing them to third parties,
especially when these provide access to portals, as in this case, from
where they can carry out certain contracts and even bank transfers.

Finally, it is reported that all of this has been brought to the attention of the

complainant, as stated in the document provided as document number two.

THIRD.- Regarding the decisions and measures taken in response to this complaint to
prevent similar incidents from occurring. In addition to all measures

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/54

Application in the specific case and which were reported to the claimant as soon as
they were located through their partner, other additional guarantee and prevention measures have subsequently been taken
to prevent similar cases from occurring in the future.

That is, from sending the aforementioned Communication, which was provided as document no.

one, to other projects to strengthen identity verification and the Protocol for
action when the issuance of a fraudulent SIM duplicate is detected, since
as has been indicated on other occasions to the AEPD, Jazztel is working

continuously to strengthen its measures to prevent new social engineering methods
and tricks used by malicious actors who commit this type of fraud, of which this
entity is also a victim.

In this regard, and given the risk of identity theft, this company reports that it is constantly updating its Action Plans to mitigate the risks of fraudulent account activations due to identity theft (SIM swaps and other types of fraud), in order to strengthen security protocols and implemented measures, as well as to prevent and anticipate the tactics of social engineering and/or malicious actors.

Specifically, it is reported that in addition to penalizing the agent from whom the impersonator obtained activation of the duplicate SIM card, who received disciplinary action for malpractice, general training and reinforcement guidelines were provided to frontline agents to ensure they follow the established security protocols and policies for various commercial transactions, both in person and remotely.

(...)

THIRD: Admission of the Complaint

On May 27, 2023, in accordance with Article 65 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), the complaint filed by the complainant was admitted for processing.

FOURTH: Preliminary Investigative Actions of the Spanish Data Protection Agency (AEPD)

The Deputy Directorate General for Data Inspection carried out

preliminary investigative actions to clarify the facts in question, pursuant to the functions assigned to supervisory authorities in
Article 57.1 and the powers granted in Article 58.1 of Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter GDPR), and in accordance with the provisions of Title VII, Chapter I, Section Two, of the

Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), having become aware of the following:

1. On February 4, 2023, according to Orange, a request for a
duplicate eSIM pending validation was registered, made by the malicious agent

by calling the telephone number 1565. The agent who answered confirmed the caller's identity
through a series of questions, verifying the match of

their basic data (Name and ID number, address, bank, to which the person
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 8/54

caller indicated “***COMPANY.3”, showing that at that moment they already
had this information from the bank where the withdrawals occurred.

It is assumed that this is a transcription error by the complainant and refers
more to ***COMPANY.1 as the bank.

Orange provides a recording of the call.

The content of the call recording has been verified with respect to the
following statements by Orange.

(…).

Additionally, Orange attaches a screenshot of the duplicate request
on 4/2/23, and its cancellation on 10/2/23, after the detection of the irregular duplicate by
the Risk Analysis, Fraud and Fraud Prevention team.

Orange states that this request was pending validation, which

never occurred This occurred because the Risk Analysis, Fraud, and Fraud Prevention Department requested its cancellation as soon as a new SIM duplicate request at the point of sale on February 10, 2023, was flagged as fraudulent and reviewed potential contracts as a preventative measure.
The aforementioned Analysis Department concluded that the malicious agent presumably possessed, for unknown reasons, a copy of the affected person's physical ID card and knowledge of their basic information, including their financial institution.

Both the point-of-sale agent and the Risk Analysis, Fraud, and Fraud Prevention team acted according to the established protocol for these cases, canceling the request as soon as the fraudulent duplication attempt was detected on February 10, 2023, reviewing other potential requests, and immediately canceling them, along with the other measures already reported.

Orange concludes that the imposter did not achieve their goal of obtaining the duplicate eSIM. to overcome the aforementioned policy to achieve effective validation (as explained, the request for the QR code was left pending validation by the system, which the person indicated they were not receiving, trying to persuade the agent), although, given that they had the personal data of the now-claimant, they overcame the security policy for email updates and provided a new address, which was updated in the systems by the agent.

Orange indicates that, regarding this possibility of changing the email address, for a customer to change their email address or contact phone number, first, (...).

Orange states that, however, the usurper did not obtain the aforementioned duplicate eSIM because they did not overcome the security policy by token, since initially they informed the agent that they had "left the card somewhere else," trying to persuade them, which they did not achieve since, finally, and to resolve the issue, they decided to use the confidential random questions, which, since they remained pending validation, were not processed, thus ending the Call.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/54

2. On February 7, 2023, the complainant states that they received an SMS from

***COMPANY.2, which they did not see until after the events occurred, regarding a fraudulent transfer

from ***COMPANY.2 (account holder (…) and the complainant as an authorized user), detected on
February 14, 2023.

3. On February 7, 2023, the complainant states that an account was opened
in their name at ***COMPANY.2 without their consent, with a transfer to
them and a loan application.

4. On February 8, 2023, the complainant states that they sent an email to

***COMPANY.1 from their email address ***EMAIL.4 as the account holder,

informing them that they received two payments via transfers of cents from

***COMPANY.2 and ***COMPANY.4, respectively, which, according to the claimant,

indicated that a third party had access to their bank details without their authorization.

5. On February 10, 2023, Orange (Jazztel) states that it internally opened
an incident of attempted SIM card duplication of line ***PHONE.1 by the

usurper, an attempt that was not processed thanks to the diligence of the agent at the
point of sale of its own store located in Madrid, who, upon verifying the identity of the
applicant, observed that a manipulated ID card was being presented. Although
it was the same and matched the one registered in the systems, the photograph was different,
belonging to a different person than the holder, and it was noted that it had been
manipulated.

Orange indicates that, at that moment, from the aforementioned point of sale in Madrid,
following the established protocol, immediate and direct notification was given to the
Risk Analysis, Fraud and Fraud Prevention Department, which
immediately The case was reviewed and it was confirmed that the ID card had been tampered with,

and the request was not processed.

Furthermore, in accordance with the established protocol, the aforementioned
Department reviewed the possibility of other attempts at fraudulent duplicates,

detecting the following:

i) On the one hand, there was a previous eSIM duplicate request made by telephone on

February 4, 2023, which was pending validation by the system for sending the
QR code. Therefore, the aforementioned Department immediately informed the requester that it should not be processed on February 10, 2023.

ii) On the other hand, the Fraud Department's analysis

detected another attempt to duplicate a SIM card, also via
telephone, which was also unsuccessful due to the effectiveness of the established security protocols. In this case, it is recorded that the applicant (imposter)
contacted the agent pretending to be the account holder, impersonating them, stating that
their phone was broken and they needed a duplicate SIM card. The agent

asked for their ID number and personal information; however, they failed to pass the
Security Policy check. The agent then asked them to complete the Security Policy check

using a token, but the applicant (imposter) (changing their message) stated that
their phone was broken and they needed a duplicate, attempting to persuade the agent.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/54

The agent then instructed them that, for security reasons, they had to go
to a store.

On the same date, February 10, 2023, the Risk Analysis, Fraud, and Fraud Prevention Department inserted a clear WARNING NOTE in all systems, in capital letters and mandatory reading before accessing them: “VERY IMPORTANT!!! THE CUSTOMER HAS BEEN THE VICTIM OF IDENTITY THEFT WITH SIM DUPLICATION. DO NOT PROCESS ORDERS AND REQUEST A PASSWORD CHANGE FOR THE CUSTOMER AREA.”

Orange provides a screenshot of the systems dated February 10, 2023, showing the aforementioned warning note.

Orange states that it has confirmed that, having detected the fraudulent duplication attempt,

from February 10, 2023, attempts were made to contact the account holder
at the three contact numbers to inform them of the duplication attempt and
the actions taken as a result, but these attempts were unsuccessful. Further attempts were made
on subsequent days until, as the claimant acknowledges, contact was finally made

on February 14, 2023, one day after a request was made via call to 1565 on February 13,

2023, for a duplicate eSIM. During this call,

the caller, impersonating the account holder and using manipulated data from their ID card and
all their personal information, managed to get the agent to create a duplicate eSIM activation file, which was validated after passing the security policy.

Orange provides the communications with the claimant recorded from February 10, 2023, to the present. (Orange Entry 23e00061618202 of September 14, 2023, document 1).

This document confirms that:

- on February 10, 2023, the aforementioned Fraud Department notification was sent;

- on February 11, 2023, four SMS messages were sent to the claimant's number ***TELÉFONO.1 with the message (…).

- On February 11, 2023, an SMS was sent to the claimant's contact number, contracted with Jazztel ***PHONE.2, with the message “(…)”.

- On February 13, 2023, an SMS was sent to the affected number of the claimant ***PHONE.1

with the message “(…)”.

- On February 13, 2023, the number 1565 shows “Action successfully completed”.

2. On February 11, 2023, Orange states that the activation of the SIM card duplicate at a point of sale in Zaragoza was carried out without irregularities, passing the identity verification measures and the security protocol, and was processed by the legitimate owner.

In this regard, point 6 of the claim states that the claimant stated that they had no coverage and went to a physical store to request a physical SIM card duplicate, which was processed, and acknowledged that from that day forward it worked correctly.

Despite It is noteworthy that he was

untraceable despite attempts to contact him, until finally, on February 14, 2023, he was reached.

3. On 2/13/23, Orange stated that a duplicate eSIM was requested via a call to 1565, during which an imposter, posing as the legitimate owner and impersonating him,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/54

using data from his manipulated ID card and personal information,

which he presumably possessed and had possessed for some time,

managed the sales agent to create an activation file for

a duplicate eSIM, bypassing the identification measures and the Security Policy

through confidential questions.

Orange indicates that, at the very moment the imposter bypassed the
Security Policies, an alert was triggered at the Department Risk Analysis,
Fraud and Fraud Prevention, detected internally that it was
the activation of a duplicate eSIM with possible identity theft, after which

it was analyzed and categorized as fraud, so the duplicate eSIM, number ***PHONE.1, was blocked. The so-called ANI was also added to a specific
Internal List to prevent future cases. This ANI,

for informational purposes, is a warning of the number from which
the impersonator calls to make the request with identity theft, in
this case, from which they called 1565 on February 13, 2023 to request the

activation of the duplicate eSIM.

It has been indicated above that it has been verified in the recording provided by
Orange of the call to 1565 in the failed attempt to duplicate the eSIM on February 4, 2023

that the security policy of this process consists In validation of personal data:

Orange provides screenshots of Jazztel's systems, showing

that the processing was observed, and that immediately that same day, hours
later, the number and the duplicate were blocked. Attempts were made to contact
the affected party, which was achieved the following day through their partner.

It is verified that the screenshot of these blocking actions

shows the date 2/14/23 and the times 3:32 PM and 3:41 PM, that is, the day after
2/13/2023.

Orange clarifies that, in addition to the aforementioned measures taken by the
Risk Analysis, Fraud and Fraud Prevention Department and
in accordance with the established internal protocol, a COMMUNICATION was sent to the
Points of Sale in Madrid, specifically to the Territorial Departments of

Sales, Sales Strategy, Security, Authorizations, Activations, Customer Service, and Logistics, communicating and warning about The detection of the individual
who is visiting various points of sale in Madrid, impersonating
customers to obtain SIM card duplicates. The aforementioned statement also includes
a clear and explicit reminder that the replacement SIM will NEVER be

given to anyone other than the account holder, even if they have a signed authorization.

Customers were also reminded that the identity document will ALWAYS be validated through
KYC/Digital Signature and will only be processed if the response is OK,”

attaching a photo of the malicious actor or agent and the manipulated ID.

Orange includes at the end, in highlighted format, a reminder of the
internal procedure in case of detecting customers with these characteristics:

sending an email to the Fraud Department and traffic management platform; with the identification document and all the documentation provided and
relevant information; all of this plus an informational call to a designated phone number.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/54

Orange provides as document number one (docunocomunicacojazztel), a copy of the

referred communication sent to points of sale in Madrid on February 13,

2023, to prevent similar cases, which contains the manipulated ID card. A comparison

with the original ID card reveals the irregularity.

It is verified that the document's content matches what Orange indicated.

According to Orange, the mandatory reading notice was inserted on February 10, 2023, by the Risk Analysis, Fraud, and Fraud Prevention Department. It is probable, and after due diligence, in light of this complaint, that the sales agent at the point of sale where the SIM card replacement was processed for the legitimate owner performed the validation regarding the customer and the line, but did not detect the mandatory reading notice included by the aforementioned Department. The agent was reprimanded for this oversight, and measures regarding this type of mandatory reading notice have been reinforced to prevent it from happening again.

Orange provides document 1 with communications with the complainant recorded from February 10, 2023, to the present, who remains an Orange customer.

The aforementioned document confirms the following messages were sent to the claimant's phone, summarized below:

- 10/2/23: Warning of identity theft risk with SIM card duplication.
- 11/2/23: Four SMS messages between 2:30 PM and 2:40 PM to finalize registration in the Jazztel customer area, sent to the mobile number subject to the claim.
- 11/2/23: 2:40 PM: An SMS reminder to access the customer area with a link to download the Jazztel app, sent to mobile number ***TELÉFONO.2, which is one of the numbers contracted by the claimant.
- 13/2/23: 8:04 AM: An SMS from Jazztel with information to activate the Data Deposit feature and a link for more information, sent to the mobile number subject to the claim. 14:26 Action completed successfully.

- 13/2/23 14:28 Email changed to ***EMAIL.1.- 13/2/23 15:56 Activated

Data, call, and outgoing SMS/MMS blocking.

- 13/2/23 19:08 Coverage lost, duplicate SIM issued, fault persists, and sent to the store for warranty.

- 14/2/23 10:28 Email changed to ***EMAIL.2.

- 14/2/23 15:32 Number blocked (claimant's) due to theft/loss.

- 14/2/23 15:41 Affected by eSIM card fraud 13/2/23.

- 18/2/23 10:46 Invoice sent to email ***EMAIL.3.

- From February 18, 2023 to May 23, 2023, actions were taken with the claimant regarding the resolution of the claim

and other inquiries.

4. On February 13, 2023, the claimant stated that they received SMS messages from Jazztel confirming successful eSIM activation

which the claimant did not see until after the fact.

It was verified that this statement corresponds with what is recorded in the aforementioned
document 1 of entry 23e00061618202, where the
communication of February 13, 2023 at 2:26 PM, stating “Action successfully completed,” appears.

5. On February 13, 2023, the claimant stated that they went to a Jazztel store due to coverage problems

but received no solution.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/54

6. On 13/2/23, the complainant states that a fraudulent transfer was made from

***COMPANY.1 as the account holder and was notified on 14/2/23 by the bank.

7. On 14/2/23, the complainant states that they received a text message warning from ***COMPANY.1, which
they did not see until after the fact.

8. On 14/2/23, the complainant states that Jazztel contacted B.B.B. as the contact
for recovering the complainant's phone number to reset the account. The claimant
states that he contacted Jazztel and was told that everything was OK; specifically, she

confirmed that they had not requested an eSIM, that the account holder was experiencing coverage issues with
the SIM card, and, after the agent warned him about identity theft that
could have had other consequences, confirmed that she had no information on
bank transactions. During that call, the agent indicated that the fraudulent transactions had been
detected and that all necessary measures had been taken immediately and directly

. He was also asked to reset his access codes for security reasons and was instructed to submit a police report.

9. On February 14, 2023, the claimant states that they received SMS messages and emails from ***COMPANY.1 to ***EMAIL.4 and ***EMAIL.5, reporting banking irregularities on February 13, 2023.


10. On February 14, 2023, the claimant states that they received verbal notification at the office of

COMPANY.2 regarding banking irregularities on February 7, 2023.

11. On February 14, 2023, the claimant states that they filed a complaint at an Orange store in Zaragoza.

12. On February 17 and 20, 2023, the claimant filed and submitted a police report.

13. On February 20, 2023, the claimant filed and submitted a complaint with ***COMPANY.1.

14. On February 21 and 29, 2023, the claimant filed and submitted a complaint with ***COMPANY.2.

15. On February 24, 2023, OE stated that the claimant filed a complaint with the attached report to the DGP (General Directorate of Police), which was notified to Orange on March 1, 2023.

Orange stated that the complaint filed with the Agency, in the section "Allegations, Preliminary Matters," indicates that the theft from the bank accounts of ***COMPANY.1 and ***COMPANY.2 "was noticed by the complainant on February 14, 2023." The police report of February 17, 2023, and the

documentation provided by the complainant, state that bank transfers were made
on February 7, 2023, and that the complainant received bank notification SMS messages from that same date. The complainant declared that they did not see these messages "until after the events occurred
due to mobile phone coverage problems. On February 11, 2023, they went to the Orange store in Zaragoza to request a duplicate SIM card,

and were given a duplicate, which was working correctly."

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 14/54

Orange has provided records from its systems and indicates that there are no records
of incidents of this nature due to previous coverage failures until February 11, 2023, when the complainant went to the store in Zaragoza to request a duplicate.

Orange states that the bank's informational SMS messages were sent starting on February 7, 2023. Regarding this, according to the police report, the affected party stated that "on February 13, 2023, the complainant received an SMS from Jazztel stating that 'YOUR ESIM CARD ACTIVATION HAS BEEN SUCCESSFULLY PROCESSED.'" YOU CAN CONSULT THE ACTIVATION INSTRUCTIONS IN

`INFO”, despite stating that “the complainant was unaware of said
SMS until everything reported happened.”

Orange indicates that in point 3 of the claim, on that day (February 7, 2023), “several bank transfer operations were fraudulently carried out

from the bank account of ***COMPANY.2 for the amount of (…) euros,” which
he states, as he was authorized, he did not realize until February 14, 2023,
a week later when he was informed by Jazztel and received notifications from
the Banking Entities. The affected party also adds that on that same day, therefore,
before the fraudulent SIM card duplication detected on February 13, 2023,

an account was opened without his consent, …at ***COMPANY.2… (…) …”. Regarding what,

in point 8 The complaint states that “on February 13, 2023…several fraudulent bank transactions were carried out from the account of
***COMPANY.1”… and finally, that “on February 14, he received communications from two banks warning of irregularities.”

Orange states that, as indicated in the complaint, the affected party, despite having received the aforementioned communications, declared that he noticed nothing until “everything reported happened,” that is, until the bank withdrawals unfortunately occurred; however, as has been demonstrated by this party, the established precautions and protocols regarding informing the affected party were followed, although due to circumstances beyond its control, this was not achieved until the aforementioned February 14, 2023.

Orange states that the disputed bank transfers, which the client is unaware of, began before the duplicate SIM card was activated. eSIM card
on February 13, 2023, which was immediately detected internally and

blocked by the Risk Analysis, Fraud, and Presumption of Fraud Department.

Orange states that the imposter previously possessed the ID of the affected account holder, which he manipulated with another photograph with the intention of carrying out fraudulent transactions.

This company is yet another victim of his schemes and social engineering.

It can be concluded that there is no causal relationship between the aforementioned eSIM duplicate of February 13, 2023, and the bank transfers of February 7, 2023, and February 13, 2023.

Orange states that due to the nature of these types of commercial transactions, which involve requests for SIM card duplicates or changes to contact information,
the established protocols for handling these cases by staff, especially at

6 Jorge Juan Street www.aepd.es
28001 – Madrid sedeaepd.gob.es 15/54

The initial procedures for this type of action are very strict and require formal measures.

Orange continues, stating that the factual account and documentation contained in the file and submitted allow them to conclude that Jazztel carried out lawful data processing with a full appearance of legality, in accordance with established protocols and current procedures. Furthermore, once the impersonator managed to bypass identification, since they possessed the owner's ID card, which they manipulated in the photograph, and considering the security policy, the fraud was detected internally.

The appropriate measures were deployed and were effective, diligent, and interoperable with the other departments, including communication to points of sale in Madrid to prevent similar cases.

Orange also concludes that there is no causal link between The

irregularities related to the SIM (specifically, on February 13, 2023, when the duplicate eSIM was activated, which was immediately deactivated and blocked due to fraud) and the transfers between February 7 and 13, 2023. As indicated, the
identity thief possessed the legitimate owner's personal data, including their ID card, which they manipulated. They already had knowledge of the affected person's personal data, which they did not access through this company, but rather

had it in their possession.

Finally, Orange informs that although Jazztel establishes security measures and
submits them to continuous review and improvement, it is inevitable that individuals, as
owners of their data, have a certain responsibility to keep their access credentials

confidential, their ID card and other personal information—as well as
reviewing notifications about possible transactions that they may not recognize or that may alarm them—without providing them to third parties, especially when these provide access to portals, as in this case, from which certain contracts and even bank transfers can be made.

Orange reports that all of this has been brought to the attention of the complainant, as stated in document number two, dated May 20, 2023.

Orange states that “regarding the decisions and measures to prevent similar incidents from occurring, in addition to all the measures applied in this specific case,

which were communicated to the complainant as soon as they were located,
further additional guarantee and prevention measures have been subsequently taken
to prevent similar cases from happening again in the future.” This includes,
from the issuance of the aforementioned statement, which was provided as document number one, to
other projects aimed at strengthening identity verification and the protocol for action

when the issuance of a fraudulent SIM card is detected, since Jazztel
is continuously working to reinforce its systems in order to prevent new
social engineering methods and tricks used by malicious actors who commit this
type of fraud, of which this entity is also a victim.

In this regard, and given the risk of identity theft, this company reports that it is constantly updating its Action Plans to mitigate the risks of fraudulent registrations due to identity theft (SIM swaps and other types of fraud), in order to strengthen security protocols and implemented measures, as well as to prevent and anticipate the tricks of social engineering and/or malicious actors.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 16/54

and to try to prevent and anticipate the tricks of social engineering and/or malicious actors. In particular, it is reported that, in addition to penalizing the agent from whom the impersonator obtained activation of the duplicate SIM card, the agent received disciplinary measures for malpractice. Training and reinforcement guidelines were provided to frontline agents to ensure they follow the established security protocols and policies for various commercial transactions, both in person and remotely.

In addition, the company is working on the full implementation of optimization and reinforcement measures for the CIAM (Customer Identity and Access Management) solution. To this end, the "Identity" project was launched to enhance the functionalities provided by new CIAM tools.

This improvement will allow us to replace or evolve the current solution to address the identified gaps. The functionalities expected to be covered by the new solution are:
• (…)

Finally, it is reported that the project is scheduled to complete the evaluation, decision-making, and implementation planning phases by the third quarter

of this year, due to the technical and development implications involved in
systems.”

FIFTH: ORANGE's Turnover

According to the report obtained from the AXESOR tool, ORANGE
ESPAGNE, S.A.U. is a large company established in 1998, with a turnover
of €4,311,999,000 in 2023.

SIXTH: Initiation of Sanctioning Proceedings

On November 19, 2024, the Director of the Spanish Data Protection Agency

agreed to initiate sanctioning proceedings against the respondent,
in accordance with the provisions of Articles 63 and 64 of the Law 39/2015, of October 1,
on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged infringement of Article 32 of the GDPR, classified in Article 83.4 of the GDPR.

SEVENTH: Allegations to the decision to initiate sanctioning proceedings

Having been notified of the aforementioned decision to initiate proceedings in accordance with the rules established in the LPACAP, the respondent requested an extension of the deadline and a copy of the file, which was granted. On December 12, 2024, the respondent submitted a statement of allegations expressing their disagreement with the grounds set forth in the Decision to Initiate Proceedings and ratifying and incorporating in full the allegations and legal arguments presented in their previous submissions:

First. – ON THE EXISTENCE OF CRIMINAL PREJUDICIALITY.

6 Jorge Juan Street www.aepd.es
28001 – Madrid sedeaepd.gob.es 17/54

It insists that the facts that are the subject of this Initiation Agreement are, in turn, the basis of a criminal investigation, and are subject to the principle of criminal prejudiciality established in Article 10 of Organic Law 6/1985, of July 1, on the Judiciary.

It points out that this matter must be resolved first through criminal proceedings, prior to any pronouncement in administrative proceedings, as this would constitute double sanctioning for the same acts, and that it is imperative to suspend these proceedings until the criminal case is resolved.

Second. – ON THE FACTUAL BACKGROUND.

The defense proceeds to a detailed chronological description of the facts, stating that three failed attempts occurred on February 4, 10, and 13, 2023, and a

successful attempt on February 13, 2023, to duplicate the claimant's eSIM.

It notes that despite the granting of said irregular duplicate SIM card, the
contract appeared entirely legal since the imposter had
in his possession all the necessary information, including confidential information (such as the claimant's
payment entity or the amount of their last bill).

It also affirms the robustness and effectiveness of the identification and
security protocols, highlighting the agent's diligent actions during the failed attempts and the
promptness in taking measures against the activation of the requested eSIM on February 13,

2023.

It indicates the lack of a causal link between the irregularities related
to the SIM (the eSIM being activated on February 13, 2023, and subsequently deactivated and blocked). Immediate action for fraud) and the transfers made

between February 7 and 13, 2023, on behalf of the Claimant.

The Claimant states that issuing a duplicate SIM card involves issuing a
blank SIM card, without any personal information. The “duplicated” SIM card is a
physically new device, whose factory configuration does not include any type of
previous information that might have been included on the previous SIM card. In other words,

the “duplicated” SIM card could be considered equivalent to a new mobile device,
when delivered to a store, where obviously no type of
information is found; rather, it will be the new owner who configures it and
includes everything they need. Therefore, it does not, in itself, allow
access to any type of banking or financial information.

The Claimant points out that the Agency omits in the Initial Agreement that, for this to happen, a
previous step is necessary, where the perpetrators They must obtain and be able to use the Claimant's banking credentials in order to identify themselves and, first and foremost, carry out identity theft with their financial institution.

In this case, it is considered proven and more than evident, given that the criminals carried out 11 bank transfers

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 18/54

to ***EMPRESA.1 and 6 to Santander on dates prior to the SIM card duplication.

It states that the security measures were effective in almost all of the attempts, and that the general dismissal of Orange's security policy is neither

founded nor justified.

Third. – ORANGE'S ROLE AS VICTIM

The defense proceeds to indicate that the request for an eSIM card via telephone call, following a policy security measures, and activation requires

knowledge not only of the applicant's personal data, but also
their personal and non-transferable access credentials to the private customer area, which demonstrates the sophistication of identity theft techniques.

Orange had measures in place that proved valid, adequate, and sufficient against virtually identical attempts at identity theft aimed at obtaining a duplicate SIM card, as evidenced in the description of the events, where up to four duplicate requests were successfully blocked. Therefore, it is crucial to reiterate the importance of correctly placing Orange in its position as the victim of a criminal attack orchestrated through its company.

Fourth. - ON THE INADMISSIBILITY OF STRICT LIABILITY.

The defendant argues that this Agency Initiation Agreement is based exclusively on a (brief) analysis of the outcome, considering that the Issuance of a duplicate SIM card resulting from a one-off manual error by an agent

automatically implies that adequate measures were not taken and,
therefore, in the opinion of the Spanish Data Protection Agency (AEPD), automatic direct liability arises
on the part of Orange.

It argues that imputing a serious infringement, with the imposition of the corresponding
sanction, based exclusively on an undesired result in an

isolated incident, constitutes the adoption of a principle of strict liability in the sanctioning sphere, which is prohibited by our legal system. It indicates that the Constitutional Court (hereinafter, “CC”), since its Judgment No. 76/1990 of April 26, has
been warning of the inadmissibility of strict liability in our legal system
and, consequently, the requirement in all cases
that the Administration, when imposing sanctions, prove some degree of intent

on the part of the sanctioned party.

It points out, This expansive interpretation of the sanctioning power (granted in this case by the GDPR), which the Agency implements in its Initiation Agreement, has been categorized as unacceptable once again by the Court of Justice of the European Union (hereinafter, “CJEU”) in its recent judgments concerning cases C-683/211 (Nacionalinis visuomenės sveikatos centras) and C-807/212 (Deutsche Wohnen).

1 Judgment of the Court of Justice of the European Union. Case C-683/21 Nacionalinis visuomenės sveikatos centras. Available at:

https://curia.europa.eu/juris/documents.jsf?num=C-683/21
2 Judgment of the Court

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 19/54

European Court of Justice. Case C-807/21 Deutsche Wohnen. Available at the following link:

https://curia.europa.eu/juris/documents.jsf?num=C-807/21 EXP202305035. In
Case C-683/2021, specifically, the CJEU stipulates: “The Lithuanian Government and the Council
of the European Union infer from this that the EU legislator intended to leave
Member States a certain margin of appreciation in the application of Article 83

of the GDPR, allowing them to provide for the imposition of administrative fines under
that provision, where appropriate, without requiring proof that the GDPR infringement
sanctioned by that fine was committed deliberately or negligently.” Such an interpretation of Article 83 of the GDPR cannot be accepted.” It continues: “…nothing in the literal wording of Article 83, paragraphs 1 to 6, of the GDPR indicates that the EU legislator intended to leave Member States some discretion regarding the substantive requirements that a supervisory authority must meet when deciding to impose an administrative fine on a controller for an infringement covered by paragraphs 4 to 6 of that Article. […] This finding is also corroborated by a joint reading of Articles 83 and 84 of the GDPR.


It asserts that Article 83 of the GDPR does not permit the imposition of an administrative fine for an infringement covered in paragraphs 4 to 6 of said article without proof that the infringement was committed deliberately or negligently by the data controller, and that, therefore, the existence of a culpable infringement is a requirement for imposing such a fine.

The Spanish Data Protection Agency (AEPD) directly contradicts the case law applicable to administrative sanctioning procedures, including Supreme Court Judgment (STS) 5298/1994 of July 9, 1994, which states: “…the sanctioning power of the Administration is of the same nature as criminal power, and therefore, the structural guidelines of administrative offenses also tend, as in criminal offenses, to achieve the individualization of responsibility, prohibiting any attempt to establish strict liability or liability based on a mere relationship with a party.” Therefore, in the area of administrative liability, it is not enough for the conduct to be unlawful and typical; it is also necessary that it be culpable, that is, the consequence of an action or omission attributable to its author due to malice or recklessness, negligence, or inexcusable ignorance (Constitutional Court Judgment, Chamber pursuant to Article 61 of the Organic Law of the Judiciary, of November 6, 1990).

In light of the foregoing, it is possible to affirm that this procedure of the Spanish Data Protection Agency (AEPD) in the Resolution is not in accordance with current legislation, as this Honorable Chamber has already indicated, among others, in the Judgment of the Administrative Chamber of the National Court, Section 1, of December 23, 2013, Appeal No. 341/2012:

“Indeed, in matters of sanctions, the principle of culpability applies (Constitutional Court Judgment 15/1999, of July 4; 76/1990, of April 26; and 246/1991, of December 19),
which means that some kind of intent or negligence must be present. As stated in the
Supreme Court ruling of January 23, 1998, "...one can speak of a
decisive line of jurisprudence that rejects strict liability in the sanctioning sphere of the

Administrative Court, requiring the concurrence of intent or
negligence, in line with the interpretation of Constitutional Court ruling 76/1990, of April 26, which indicates that
the principle of culpability can be inferred from the principles of legality and prohibition
of excess (Article 25 of the Constitution) or from the requirements inherent to the rule of law. The issue, therefore, must be resolved in accordance with the principles of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 20/54

punishment law, given that mere human error cannot, in itself (and
especially when it occurs in isolation), give rise to the attribution of consequences
of sanctions; because, if this were done, it would entail a system of strict liability

prohibited by our constitutional order. In the area of personal data protection, for this error to be relevant for punitive purposes, it must be a consequence of—or made possible by—the absence of prior and adequate control procedures aimed at its prevention.

Only in this way will a factor of culpability appear on the part of the company, attributable to negligence (or "simple non-compliance") due to the lack of established protocols or security procedures. But these deficiencies must be subject to investigation and proof by the sanctioning administrative body (which bears the burden
of carrying them out, thus overturning the presumption of innocence).

And, in the same vein, it is appropriate to cite the Judgment of the National Court, Administrative Chamber, of February 25, 2010, Appeal No. 226/2009, which specifically states: “The Data Protection Act (LOPD) establishes an obligation of result,
consisting of adopting the necessary measures to prevent data from being lost, misplaced, or falling into the hands of third parties. This obligation is not absolute and cannot encompass a case such as the one analyzed. In the present case, the result is

a consequence of an intrusive activity, not protected by law and
therefore illegal, by a third party with advanced computer skills who, by breaching the established security systems, accessed the database of users registered at www.portalatino.com, downloading a copy of it.

And, these acts cannot be attributed to the appellant entity because, otherwise, it would violate the principle of culpability.”

It is worth noting the similarity of the present factual scenario with that described in the
excerpted Judgment of the National Court (hereinafter, SAN) of February 25,

2010: these are intrusions committed illegally by third parties with
knowledge of computer systems and technology, aimed at criminal activity.

Furthermore, the imposition of an obligation of result by data protection regulations in the deployment of security measures has been overturned by the
Judgment of our Supreme Court, STS 543/2022, of February 15, which
establishes in its Legal Basis 3, and sets a precedent; that: “The obligation

to adopt the necessary measures to guarantee the security of personal data cannot be considered an obligation of result, implying that
in the event of a personal data breach to a third party, liability exists
regardless of the measures adopted and the activity carried out by the
data controller or processor.”

Thus, the Supreme Court defines this obligation as an obligation of means, in which (Legal Basis 3): “the commitment undertaken is to adopt the technical and organizational means, as well as to carry out diligent activity in their implementation and use, aiming to achieve the expected result with means that can reasonably be considered suitable and sufficient for their attainment; therefore, they are called obligations of diligence or of conduct.” The difference lies in the responsibility in each case, since while in the obligation of result one is liable for a harmful outcome due to the failure of the security system,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 21/54

whatever its cause and the diligence used, “in the obligation of means it is sufficient to establish technically appropriate measures and implement and use them with reasonable diligence.”

This is why this party considers that the present Commencement Agreement is not

in accordance with the law, as it imposes on ORANGE an obligation of result, consisting
of the establishment of infallible measures, by imputing an infringement of Article 32 of the
GDPR based solely on the harmful result produced by the
fraudulent intervention of a third party, without considering the diligence used, without
considering the deployment of technically adequate and implemented measures, nor the
negligent conduct of the data subject himself, who received repeated SMS messages from the

banking entities informing him of transfers days before the SIM card was duplicated, which indicated an intrusion into his online banking that facilitated the
subsequent duplication.

In this regard, it is important to emphasize that the implementation of

unbreakable measures is neither feasible, since every measure, however secure it may be, and
even with the appropriate security guarantees and certifications, has
vulnerabilities; nor is it required by the applicable regulations.

It is Therefore, it is not possible to find Orange culpable in the present case, and the assessment made by the Agency regarding the commission of an infraction by this company is not legally valid.

Fifth. – ON THE CORRECT IMPLEMENTATION OF SECURITY MEASURES.

5.1. Orange argues that it cannot be concluded that there is a lack of effectiveness in the measures adopted, since these have functioned correctly, halting attempts to duplicate SIM cards.

Secondly, in this regard, it is important to emphasize the role of the Agents, without whom a telecommunications company like Orange could not operate in the market. Human intervention is necessary for this, and their total elimination from process management is not possible. These agents are also a highly effective and necessary measure insofar as they are capable of detecting fraudulent activities. This can be seen, for example, in the alert issued by an agent at the point of sale. from a company-owned store located in Madrid, who,
upon verifying the applicant's identity, observed that a manipulated ID card was being presented. Although it was the same ID card and matched the one registered in the systems, the photograph was different, belonging to a different person than the holder, and it was noted that it had been manipulated. This due diligence, required of each and every agent and highly effective, cannot be eliminated.

The Spanish Data Protection Agency (AEPD) cannot expect total control or limitation of their operational capabilities, insofar as Orange (like any other entity) hires them precisely to perform actions within its systems and interact with its customers. In this context, the measures to control their actions are constituted by the employment contract, by which they are legally obligated to act in accordance with Orange's instructions, as well as the traceability of the systems, which ensures they are identified at all times while performing their duties.

6 Jorge Juan Street www.aepd.es
28001 – Madrid sedeaepd.gob.es 22/54

Following these measures, in relation to the case at hand, the agent who facilitated the activation of the requested document was penalized. Specifically, the agent received disciplinary action for malpractice.

Additionally, in order to disseminate information about the incident and its consequences, training was conducted and general reinforcement guidelines were issued to frontline agents, reiterating the need to comply with the established protocols and security policies for various commercial transactions, both in person and remotely.

Therefore, this Agency cannot conclude that a single error by an Agent, who has received the corresponding training and is familiar with the protocols, resulting from a sporadic and isolated oversight, constitutes a general weakness in the company's Security Policy. This is especially true given that said policy has served as an effective method on numerous occasions as a shield against attempts to duplicate SIM cards belonging to individuals other than the cardholder.

5.2. Regarding the position of banking institutions in the procedure and the lack of security measures established by them:

The SIM card does not contain the data of the phone or mobile device, therefore, access to a duplicate SIM card does not allow a third party access to the applications that the Claimant may have installed on it, such as those belonging to banking institutions.

Two-step verification mechanisms are more vulnerable and discouraged, as the second step can be intercepted since it is usually something sent to us, generally via SMS.

Orange points out that it is relevant to mention the 2021 report from the State Attorney General's Office dedicated to "Cybercrime," referenced by the Spanish Data Protection Agency (AEPD) in the sanctioning procedure, which mentions the following regarding SIM swapping: "The technique consists of circumventing the security measures of banking institutions by accessing the one-time alphanumeric confirmation codes generated during electronic transactions and which are usually communicated to customers via SMS messages." In that same document, the Attorney General's Office identifies telephone operators as entities that suffer this type of fraud, which can extend to other legal entities, such as mobile phone repair shops.

Thus, it defies all legal logic to shift the entire responsibility to the entity
providing telephone services, given that it is merely the communication channel
selected by the financial institution itself, and the institution has no knowledge whatsoever
that the data transmitted through the messages contains

bank transaction codes.

It points out that ORANGE does not offer online trust services to banking operators,

nor does it offer services typical of a certification or accreditation body. The
banking institutions may not have contracted any services from ORANGE, and yet

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 23/54

they may still use SMS to carry out their transactions with clients. Therefore, ORANGE cannot be held responsible for the configuration of SMS sending as a
second authentication factor used by providers of other services, such as

banking operators.

Therefore, it is reiterated that the responsibility of telephone operators for cases of identity theft related to requests for SIM card copies cannot extend to those arising from banking transactions that criminals may carry out as a result of inadequate security measures implemented by financial institutions.

ORANGE cannot be held responsible for the security of third-party transactions simply because they use telecommunications services.

On the one hand, regarding the transfers made within the company, these occurred entirely on February 7, 2023, as reflected in the claim filed by the claimant.

On the other hand, regarding Bank ***COMPANY.1, it can be observed that up to six (6) transfers were made in the Claimant's name prior to

the issuance of the duplicate SIM card by ORANGE, specifically on February 11, 2023, totaling (…) euros:

This demonstrates that the perpetrators had all the necessary information
regarding access to the bank. Only two of the

eight transfers affecting Bank ***COMPANY.1 occurred after the
issuance of the duplicate SIM card.

Therefore, it can be concluded that there is no connection whatsoever between the duplicate eSIM card
issued on February 13, 2023, and the transfers made on that same

day.

Since the perpetrators possessed the necessary information to impersonate the Claimant with the banks beforehand.

In other words, a duplicate SIM card was not necessary to carry out the bank transfers, as these had been made previously and reached amounts exceeding the total of those made on February 13, 2023.

Specifically, (…) euros were withdrawn without the duplicate SIM card being activated. Therefore, ORANGE should not be held liable in any way regarding the bank transfers made, since, as has been demonstrated, all but two of them were made before the duplicate eSIM card was issued.

5.3. Additional security measures implemented by ORANGE.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 24/54

The respondent reiterates the security measures already listed in the information request to this Agency.

Sixth. – REGARDING THE COMPLAINANT'S LACK OF DILIGENCE AND ORANGE'S LIABILITY.

Orange alleges the complainant's lack of diligence. This applies not only to the safekeeping of his personal data but also to his failure to receive notifications. This includes notifications related to requests for duplicate SIM cards sent by Orange, as well as those from banks. The complainant reiterates that it was not until February 14, 2024, after contacting his wife by phone, that he became aware of the situation.

It is stated that the aforementioned messages reflect a clear lack of compliance on the part of the
Complainant, who was warned on multiple occasions by the three
entities and, in particular, by ORANGE, which, moreover, persistently attempted to
contact him and his wife by telephone. Additionally, throughout this document and the previous ones submitted to the Agency, which are included in the
File of the Sanctioning Procedure, it can be seen that the

Complainant did not properly safeguard his personal data, allowing access to it by third parties who fraudulently acted on his behalf.

Therefore, Orange cannot be held to an unwavering level of diligence when
it is the data subject himself who has allowed wrongdoers to dispose of it at their

discretion.


As a result, Orange cannot be held responsible for the mismanagement carried out by
the responsible party regarding personal data, allowing access to said data by
third parties without any authority or legal basis to process it.

Orange indicates that in this case: 1. It has been proven that Orange's systems functioned effectively, halting various attempts by the alleged impersonators to duplicate
SIM cards. 2. The bank transactions carried out have been shown, based on information provided by the financial institutions themselves, to be inconsistent with the

time during which the eSIM card could have been in the hands of third parties. This is because the majority
of the amounts stolen from the Claimant resulted from transfers made
prior to the issuance of the unauthorized SIM card duplicate.

Seventh. - ON THE LACK OF PROPORTIONALITY OF THE

PROPOSED SANCTION.


In this regard, the following points, which, according to the Agency's interpretation, are considered aggravating factors, are noteworthy, although the circumstances for their consideration in relation to the analyzed facts are not present:

• The nature and seriousness of the infringement (Article 83.2 a) of the GDPR). When imposing this aggravating factor, the value of sales made by

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 25/54

ORANGE, as well as the number of employees listed in the last financial statement submitted and processed, for the year 2023, are taken into consideration, in accordance with the provisions of the Sanctioning Procedure File.

Therefore, attributing the alleged infringement to all of the company's customers.

Regarding this, we would like to inform the Agency that not all ORANGE customers are natural persons (whose personal data is subject to the regulations that concern us) nor do all ORANGE customers, much less, request a duplicate SIM card, and even less so, as in the case at hand, a duplicate eSIM card.

Thus, contrary to what is stated in the Initial Agreement, not all ORANGE customers are affected by the eSIM card duplication procedure, and they cannot even be considered potentially affected.

As a result, this consideration cannot be used to increase a penalty under Article 32, since these actions have nothing to do with the diligence and measures taken by ORANGE, but rather with those of other entities.

• The link between the defendant's business activity and the processing of personal data of clients or third parties (Article 83.2.k of the GDPR in conjunction with Article 76.2.b of the LOPDGDD).

While it is true that ORANGE's activity necessitates the processing of its clients' personal data, this factor is ambiguous in its assessment for inclusion as an aggravating circumstance, since this link does not imply a direct relationship with the alleged infringement. Article 83.2 k) requires that this aggravating circumstance be linked to the specific facts of the case.

• Intentionality or negligence in the infringement. Although the Agency includes this aggravating circumstance in the Initial Agreement, it does not relate it to or indicate its application to the present facts of the case. As we have mentioned, the CJEU itself has clarified that the imposition of coercive sanctions by the administrative authority is only admissible in cases where culpable conduct on the part of the Data Controller or Data Processor is found. Since this is an indispensable requirement for the imposition of a fine by the supervisory authority, the application of this aggravating circumstance should be reserved for cases where the intent or negligence of the infringement is evident and serious. Given that the present case is unprecedented, it does not seem permissible, when this company holds the role of victim, to impute such an aggravating circumstance to it.

However, and in accordance with Article 83.2 of the GDPR and Article 76.2 of the LOPDGDD, the following mitigating circumstances exist in this case, which have not been considered in the appropriate determination of the penalty:

• The defendant blocked the line as soon as it became aware of the facts, as described in the Second Allegation (Art. 83.2 c).

• No special categories of data were processed at any time (Art. 83.2 g).

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 26/54

• ORANGE's level of cooperation with the Spanish Data Protection Agency (AEPD) in order to remedy an alleged infringement and mitigate its potential adverse effects: it has been demonstrated that all information requests made by this Agency were answered in a timely manner, in accordance with the company's usual practice of full cooperation with the data protection authority, as well as the restoration of the Complainant's situation to its original state (Art. 83.2 f).

• Adherence to codes of conduct pursuant to Article 40 or to approved certification mechanisms pursuant to Article 42 (Art. 83.2 j). In addition to the

information already contained herein regarding the measures adopted by
ORANGE to mitigate risks in SIM card duplication processes,
the certificate issued by AENOR is attached as Document No. 3, which accredits
that ORANGE has had an approved
Compliance System in place since September 4, 2023, that meets all the requirements of Article 31 bis of the

Criminal Code, as well as the other compliance standards regarding
crime prevention, such as Circular 1/2016, of January 22, from the State Attorney General's Office,
aimed at mitigating any risk of committing crimes within the
framework of ORANGE's operations.

• The non-existent benefit obtained by ORANGE from the processing of

data that is the subject of this procedure. In any case, ORANGE has been harmed
(Art. 83.2 k). In this regard, ORANGE intends to state and demonstrate
that the measures in place at the time of the alleged infringement complied with the
most rigorous rules, guidelines, standards, and recommendations for addressing
the risks and that they were appropriate and suitable considering the state of the art,

the costs of implementation, and the nature, scope, context, and purposes of the
processing, as well as the risks to the rights and freedoms of natural persons.

ORANGE concludes by expressing its willingness to cooperate with the Spanish Data Protection Agency (AEPD) and its acceptance

of any proposals for improvement or recommendations from this Agency
regarding compliance with the regulations.

EIGHTH: On October 14, 2025, the case officer issued

the proposed resolution, which was notified electronically on October 15, 2025.

The proposed resolution stated: “That the Presidency of the Spanish Data Protection Agency sanction ORANGE ESPAGNE, S.A.U., with Tax Identification Number A82009812,
for an infringement of Article 32 of the GDPR, as defined in Article 83.4 of the GDPR,

with a fine of TWO HUNDRED AND THIRTY THOUSAND EUROS (€230,000).”

NINTH: On October 16, 2025, ORANGE requested an extension of the deadline

to submit arguments against the proposed resolution, which was granted. On November 6, 2025, ORANGE submitted a document essentially reproducing the same arguments made against the agreement to initiate the proceedings. The content of this document is summarized in Legal Basis IV, "Response to the arguments submitted against the Proposed Resolution."

From the actions carried out in this proceeding and the documentation contained in the file, the following facts have been established:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 27/54

PROVEN FACTS

The following facts have been established by ORANGE in the statements made in its written submissions to this Agency dated December 12, 2024:

1. On February 4, 2023, the first attempt to duplicate an eSIM was made. This was carried out through a telephone request to Jazztel's customer service. The eSIM duplication failed. The third-party impersonator passed the security policy by obtaining the claimant's data, but failed the validation process due to the missing token and the failure to answer the confidential random questions. Validation remains pending. However, although the

duplicate eSIM could not be activated, the imposter, allegedly impersonating the account holder,
did manage to change the contact email address before the duplicate was requested.

2. It is recorded that the third party contacted Jazztel Customer Service again on February 6, 2023, impersonating the account holder and claiming

that his phone was broken and he needed a duplicate SIM card. The agent asked for his ID number and personal information; however, he failed the security verification process. He was then asked to complete the security verification process using a token, but the imposter (changing his strategy) stated that his phone was broken and he needed the duplicate, trying to persuade the agent. The agent then instructed him that, for security reasons, he had to go to a store. This SIM card duplicate was also not granted.

3. On February 10, 2023, a third attempt was made to duplicate the SIM card for line ***TELÉFONO.1. This attempt was unsuccessful thanks to the diligence of the sales agent at the company's own store in Madrid, who, upon verifying the applicant's identity, noticed that a manipulated ID card was being presented.

Although it was the same ID card and matched the one registered in the system, the photograph was different, belonging to a different person than the cardholder, and it was noted that the ID had been altered.

4. On the same date, February 10, 2023, the Risk Analysis, Fraud, and Fraud Prevention Department posted a clear WARNING NOTE in all systems, in capital letters and mandatory reading: “VERY IMPORTANT!!! THE CUSTOMER HAS BEEN THE VICTIM OF IDENTITY THEFT WITH SIM DUPLICATE.

DO NOT PROCESS ORDERS AND REQUEST A PASSWORD CHANGE FOR THE CUSTOMER AREA.”

5. On February 13, 2023, a third party requested a new duplicate eSIM through Jazztel's customer service, impersonating the claimant.

The Jazztel agent activated the duplicate eSIM, bypassing the identification measures and Security Policy through confidential questions.

The eSIM was deactivated and blocked on February 14, 2023.

6. It is an undisputed fact that the claimant did not contact Orange regarding the activation of the duplicate SIM card. Orange contacted the claimant's partner on February 14, 2023.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 28/54

LEGAL BASIS

I. Jurisdiction

In accordance with the powers conferred upon each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure.

Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) stipulates that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, subsidiarily, by the general rules on administrative procedures."

II. Preliminary Issues

Article 4 of the GDPR, entitled “Definitions,” establishes in paragraphs 1, 2, and 7:

“For the purposes of this Regulation, the following definitions shall apply:

1) ‘personal data’ means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;

2) ‘processing’ means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available.” of
access, comparison or interconnection, limitation, erasure or destruction;(...);

7) “controller” or “controller” means the natural or legal person,

public authority, agency or other body which, alone or jointly with others, determines the
purposes and means of the processing; where Union or Member State law determines the
purposes and means of the processing, the controller or the
specific criteria for its appointment may be laid down by Union or Member State law (...);”.

In the present case, in accordance with the provisions of Articles 4.1 and 4.2 of the GDPR,
the processing of personal data by ORANGE,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 29/54

is established, since it is the entity that determines the purposes and means of such activity, pursuant to Article
4.7 of the GDPR.

III. Response to the Objections to the Commencement Agreement

In response to the objections presented by the respondent, the following should be noted:

First. – ON THE EXISTENCE OF CRIMINAL PREJUDICIALITY.

ORANGE states that these events are currently the subject of a criminal investigation, and therefore considers that, pursuant to the principle of criminal prejudiciality established in Article 10 of the Organic Law of the Judiciary,

the matter should not be resolved administratively until it is resolved criminally. This, it states, is because the proven facts will bind the Agency with respect to a possible sanctioning procedure, in accordance with the provisions of Article 77.4 of Law 39/2015.

It should be noted that Article 77.4 of Law 39/2015 establishes that the facts established in Article 10 of the Organic Law of the Judiciary are subject to criminal proceedings. Article 77.4 of Law 39/2015, of October 1, on the

Common Administrative Procedure of Public Administrations (LPACAP): “In sanctioning proceedings, the facts declared proven by
final criminal court rulings shall be binding on Public Administrations
with respect to the sanctioning proceedings they conduct.” However, it must be noted that the necessary triple identity for applying Article 77 of the

LPACAP (of subject, fact, and grounds) does not exist between the administrative infraction being assessed and the possible criminal infraction or infractions that could arise from the
alleged preliminary proceedings carried out by a jurisdictional body. This is because the
offending party would obviously not be the same – with respect to violations of the
LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), the responsible party is ORANGE, whereas the criminally responsible party for a

potential crime of identity theft or fraud would be the third party who
impersonated the claimant. Nor would the legal basis be the same:
while the legal right protected by the LOPDGDD is the fundamental right to the
protection of personal data, the legal right protected in the criminal offenses
whose commission would be investigated, if necessary, by the Investigating Court would be different (property).

In this regard, the judgment of the National Court of 27/04/2012 (appeal no. 78/2010) is very enlightening, in whose
Second Legal Basis the Court rules in the following terms regarding
the appellant's claim that the Spanish Data Protection Agency (AEPD) has infringed Article 7 of Royal Decree

1398/1993 (the regulation that remained in force until the entry into force of the LPACAP): “In this regard,

Article 7 of Royal Decree 1398/1993, of August 4, on the procedure
for the exercise of sanctioning powers, only provides for the suspension of the
administrative procedure when the actual and real existence of a
criminal procedure is verified, if it is considered that there is an identity of subject, act, and
legal basis between the administrative infraction and the criminal infraction that

could correspond.

However, for a criminal prejudiciality to exist, it is required that it
directly condition the decision to be made or that it be essential
to resolve the matter, prerequisites that are not met in the case under examination, in which there is
a separation between the acts for which the sanction is imposed in the resolution now

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 30/54

appealed and those invoked by the appellant as possible criminal offenses. Thus, even if, in the present case, and due to the facts now in dispute, criminal proceedings had also been initiated against the distribution company, the fact remains that both the

sanctionable conduct and the protected legal interest are different in each of the two legal avenues (administrative and criminal). In the criminal sphere, the protected legal interest is
possible document forgery and fraud, while in the administrative sphere, it is the
right of the data subject to dispose of their personal data. Therefore, this objection by the defendant must be rejected.

In light of the foregoing, the issue raised by the defendant cannot succeed and must be rejected.

Second. – ON THE FACTUAL BACKGROUND.

Regarding the claim that issuing a duplicate card is insufficient to carry out banking transactions on behalf of the account holders, it is certainly true that, to complete the fraud, a third party must impersonate the data subject with the financial institution. This inherently involves processing data outside the bounds of the principle of lawfulness, since a third party is processing data, having access to it, without any legal basis,

in addition to violating other principles such as confidentiality.

For this reason, the due diligence exercised by the operators is fundamental to preventing this type of fraud and GDPR violations. This diligence translates into establishing appropriate measures to guarantee that data processing complies with the GDPR.

The actions of banking entities that provide payment services deserve the same considerations, as these types of scams originate within their sphere, since the third party has access to the affected user's credentials and impersonates them.

Since these entities are responsible for processing their customers' data, they have the same obligations as those previously outlined for mobile operators regarding compliance with the GDPR and the LOPDGDD, as well as those arising from Royal Decree-Law 19/2018 of November 23, on payment services and other urgent financial measures.

The eSIM issuance process does not require a physical card; instead, activation requires the applicant to scan a QR code sent electronically (SMS or email).

In this case, it has been established that ORANGE provided a duplicate of the complainant's eSIM card to a third party without their consent. This third party then accessed the information stored on the mobile phone, including bank details, passwords, email address, and other personal data associated with the device.

Therefore, the respondent failed to take the necessary precautions to prevent this from happening.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 31/54

Furthermore, it has been established that a third party accessed the complainant's private online customer area and changed their email address, subsequently initiating a conversation with the Assisted Digital Channel and requesting a duplicate eSIM through this channel.


From the established facts, it is deduced that Orange provided a duplicate eSIM card to a third party other than the legitimate owner of the mobile line, after the third party bypassed the existing security policy, which demonstrates a breach of the duty to protect customer information.

THIRD. – ORANGE'S ROLE AS VICTIM

The defense argues that requesting an eSIM card via telephone

by bypassing a security policy and requiring, for its activation, knowledge not only of the applicant's personal data, but also their access credentials to the private, personal, and non-transferable customer area, demonstrates the sophistication of the identity thieves' techniques.

That Orange had measures in place that proved to be valid, adequate, and
sufficient against virtually identical attempts at identity theft aimed at
obtaining a duplicate SIM card, as evidenced in the
description of the events, where up to three duplicate requests were successfully blocked. It is therefore crucial to reiterate the importance of correctly placing ORANGE

in its position as the victim of a criminal attack orchestrated through its company.

To deny the existence of negligent conduct on the part of ORANGE would be tantamount
to acknowledging that its conduct—whether by action or omission—was diligent. Obviously, we do not
share this perspective of the facts, since the

lack of due diligence has been proven. The judgment of the National High Court (SAN) of October 17, 2007 (appeal no. 63/2006) is very illustrative. Given that these are entities whose activity involves the continuous processing of customer data, it states that “…the Supreme Court has consistently held that negligence exists whenever a legal duty of care is disregarded, that is, when the offender does not act with the required diligence. And in assessing the degree of diligence, special consideration must be given to the professionalism of the individual, and there is no doubt that, in the case now under examination, when the claimant's activity involves the constant and extensive handling of personal data, the rigor and meticulous care to comply with the relevant legal provisions must be emphasized.”

Thus, in this regard, the National High Court ruling of September 19, 2023 (appeal no. 403/2021) indicates that

“…the insurance policy was contracted with a third party without sufficient control or supervision, since it was unable to detect that the person expressing their intention to contract was not who they claimed to be. Had the necessary precautions been taken to ensure the identity of the contracting party (for which it would have been sufficient to address the incorrect answers to the client identification and verification questions), ultimately, due to a lack of due diligence, the complainant's data was processed without their consent.”

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 32/54

It is established in the file that adequate security was not guaranteed in the processing of personal data, given the result of the identity theft. In other words, a third party managed to access the personal data of the line owner without the security measures that ORANGE claims to have in place being able to prevent it. Therefore, we are faced with the occurrence of a typical, unlawful, and culpable act.

FOURTH. - ON THE INADMISSIBILITY OF STRICT LIABILITY.

The respondent argues that the Agency's Initial Agreement is based
exclusively on a (brief) analysis of the outcome, considering that the issuance of
a duplicate SIM card resulting from a single manual error by an Agent
automatically implies that adequate measures were not adopted and,
therefore, in the opinion of the Spanish Data Protection Agency (AEPD), automatically gives rise to direct liability

on the part of ORANGE.

Regarding ORANGE's conduct, it is considered to fall under the category of negligence.

As a large-scale custodian of personal data, and therefore accustomed
to or specifically dedicated to the management of customers' personal data, it must be especially diligent and careful in its processing. In other words,

from the perspective of culpability, this is an avoidable error, since with the
application of appropriate technical and organizational measures, these identity thefts
could have been prevented.

Recital 74 of the GDPR states:

The controller's responsibility for any processing of personal data carried out by the controller or on behalf of the controller must be established. In particular, the controller must be obliged to implement appropriate and effective measures and must be able to demonstrate the compliance of processing activities with this Regulation, including the effectiveness of the measures. Such measures must take into account the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons. Furthermore, recital 79 states: The protection
of the rights and freedoms of data subjects, as well as the responsibility of
controllers and processors, including with regard to
supervision by supervisory authorities and the measures taken by

them, requires a clear allocation of responsibilities under this
Regulation, including cases where a controller determines the purposes and
means of processing jointly with other controllers, or where
processing is carried out on behalf of a controller.

In this regard, it is worth recalling Supreme Court Judgment No. Judgment 188/2022, of February 15 (appeal no. 7359/2020), states in its fourth legal ground: “The fact that it was the negligent action of an employee does not exempt her from her responsibility as the person in charge of the correct use of the security measures that should have guaranteed the proper use of the designed data recording system. As we already held in Supreme Court Judgment no. 196/2020, of February 15, 2021 (appeal no. 1916/2020), the data processor is also responsible for the actions of its employees and cannot excuse itself based on its own diligent actions, separately from the actions of its employees. Rather, it is the "culpable" actions of the latter, resulting from the violation of the existing security measures, that form the basis of the data processor's responsibility.”

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 33/54

The company is subject to sanctions for actions "inherent" to its employees or officers, not to those of third parties.

The computer system and technologies involved must be adequate to prevent identity theft and be properly configured.

This Agency does not agree with ORANGE's assertions regarding the proven circumstances.

Regarding due diligence, it is acknowledged that ORANGE has acted diligently to minimize the impact on potential victims by implementing new security measures to prevent similar incidents from occurring in the future.

Indeed, the principle of liability established in Article 28 of the LRJSP (Law on the Legal Regime of the Public Sector)
stipulates that: “Only natural and legal persons, as well as, when a law recognizes their legal capacity, groups of affected parties, associations and entities without legal personality, and independent or autonomous assets, may be sanctioned for acts constituting administrative offenses, provided they are responsible for said acts due to intent or negligence.”

However, the method of attributing liability to legal persons does not correspond to the forms of intentional or negligent culpability that are attributable to human conduct.

Therefore, in the case of offenses committed by legal persons, although the element of culpability must be present, it is necessarily applied differently than it is with respect to natural persons.


According to Constitutional Court Ruling 246/1991, "(...) this distinct construction of imputability of authorship
of the infringement to the legal entity arises from the very nature of the legal fiction
to which these subjects respond. They lack the volitional element in the strict sense,
but not the capacity to infringe the rules to which they are subject.

Capacity to infringe and, therefore, direct blameworthiness derives from the legal
interest protected by the infringed rule and the need for said protection
to be truly effective, and from the risk that, consequently, the legal entity subject to compliance with said rule must assume" (in this sense, Supreme Court Ruling of November 24, 2011, Appeal No. 258/2009).

To the foregoing, it must be added, following the judgment of January 23, 1998,
partially transcribed in the Supreme Court judgments of October 9, 2009, Appeal No. 5285/2005, and of October 23, 2010, Appeal No. 1067/2006, that "although the culpability of the conduct must
also be subject to proof, it must be considered, in order to assume the

corresponding burden, that ordinarily the volitional and cognitive elements
necessary to assess it form part of the proven typical conduct, and that their
exclusion requires proof of the absence of such elements, or, in its
normative aspect, that the diligence required of the party alleging their
non-existence has been employed; in short, the mere invocation of the absence of culpability is insufficient for exoneration from conduct that is
typically unlawful."

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 34/54

Therefore, the claim of lack of culpability is dismissed. Ultimate responsibility
for the processing remains with the data controller, who determines the
existence of the processing and its purpose. It is worth recalling that, in general,

operators process their customers' data under the provisions of Article
6.1.b) of the GDPR, as this processing is considered necessary for the performance of a
contract to which the data subject is a party.

FIFTH. – ON THE PROPER IMPLEMENTATION OF SECURITY MEASURES.

Regarding security measures, ORANGE reiterates its previous statements.

The computer system and the technologies involved must be adequate to prevent identity theft and be correctly configured.

It is true that protocols exist to prevent identity theft in these processes; that they have been communicated to those involved in the processing; that improvements have been introduced after certain vulnerabilities were discovered; and that there are penalties for non-compliance. However, we do not agree that these protocols or internal procedures can be considered adequate, as they are susceptible to improvement. Identification and authentication mechanisms must be reinforced with technical and organizational measures that are particularly appropriate to prevent identity theft.

Furthermore, to complete the scam, a third party must impersonate the data subject to receive a duplicate eSIM card. This

implies, a priori, processing outside the bounds of the principle of lawfulness, since a third party is
processing data, having access to it, without any legal basis, in addition to violating other principles such as confidentiality.

For this reason, the diligence exercised by the

operators is fundamental to preventing this type of scam and GDPR violations.

This diligence translates into establishing appropriate measures to ensure
that suitable security measures are implemented and maintained to effectively protect
the confidentiality, integrity, and availability of all personal data for which they are responsible, or that which they hold on behalf of

another controller.

The Constitutional Court stated in its Judgment 94/1998, of May 4, that we are dealing with a fundamental right to data protection, which guarantees individuals control over their data—any personal data—and over its use and purpose, in order to prevent its illicit trafficking or use that is harmful to the dignity and rights of those affected.

Thus, the right to data protection is configured as a right of citizens to object to the use of certain personal data for purposes other than those that justified its collection.

For its part, in Judgment 292/2000, of November 30, it considers it an

autonomous and independent right consisting of the power of disposition and
control over personal data, which empowers the individual to decide which of those
data to provide to a third party, whether the State or a private individual, or which that

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 35/54

third party may collect, and which also allows the individual to know who possesses that personal data and for what purpose, and to be able to object to that possession or use.

SIXTH. – ON THE COMPLAINANT'S LACK OF DILIGENCE AND ORANGE'S

LIABILITY.

ORANGE alleges a lack of due diligence on the part of the Claimant and
alleges that in this case: 1. It has been proven that ORANGE's systems
functioned effectively, halting various attempts by the alleged impersonators to duplicate the SIM card.

2. The bank transactions
carried out have been shown, based on information provided by the financial institutions themselves, to not correspond to the time the eSIM card could have been in the hands of third parties. This is because most of the amounts
stolen from the Claimant resulted from transfers made prior

to the issuance of the unauthorized SIM card duplicate.

In this case, it has been established that Orange provided a duplicate of the claimant's eSIM card to a third party without their consent and without verifying the third party's identity. This third party accessed information stored on the mobile phone, such as bank details, passwords, email address, and other personal data associated with the device. Therefore, the defendant failed to verify the identity of the person who requested the duplicate eSIM card and did not take the necessary precautions to prevent this from happening.

Based on the foregoing, in this case, the diligence exercised by the defendant in identifying the person who requested a duplicate eSIM card is called into question.

This is established, as acknowledged by the defendant in their response to this Agency and in the arguments presented: <<(...)>>.

In short, the operator's rigor in verifying the identity of the eSIM card holder or their authorized representative requesting a duplicate should be subject to strict requirements. The issue is not that the information in question is not contained on the eSIM card, but rather that if the identity of the applicant is not properly verified during the process of issuing a duplicate eSIM, the operator would be facilitating identity theft.

Regarding the fact that third parties have not obtained personal data from Orange, and therefore there can be no breach of protection measures, it should be noted that access to a duplicate eSIM card, which identifies its holder, falls under the definition of personal data in Article 4.1 of the GDPR.

SEVENTH. - ON THE LACK OF PROPORTIONALITY OF THE PROPOSED SANCTION.

The respondent disagrees with the factors considered in determining the seriousness of the infringement and the aggravating circumstances applied.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 36/54

However, the allegations made by the respondent are insufficient to refute the arguments presented and must therefore be dismissed.

Regarding the penalty, the respondent argues that it is disproportionate to the facts, taking into account the circumstances and the nature of the alleged infringement.

With respect to the breach of the principle of proportionality, the GDPR expressly provides for the possibility of graduated penalties, through the provision of fines that can be adjusted based on a series of circumstances specific to each individual case.

Orange states that the circumstances outlined in Article 83.2 of the GDPR, in sections a) and b), cannot be considered aggravating factors.

These circumstances are taken into account as determining factors in the level of severity of the infringement; that is, they are considered when assessing the severity of the infringement for the purpose of determining the amount of the fine, but not as aggravating circumstances.

However, in this case, it is not apparent that the measures implemented by Orange to prevent and detect the fraudulent issuance of a copy of the SIM card lacked due diligence. These measures allowed Orange to prevent various attempts at fraud, and when the impersonator managed to circumvent the security policy, the applied detective measures alerted them to the potential fraud, and the company contacted the complainant's partner.

This should be considered when assessing the severity of the infringement and determining the amount of the penalty.

Therefore, ORANGE's arguments in this regard are upheld.

Furthermore, it is noted that, in accordance with Article 83.2 of the GDPR and Article 76.2 of the LOPDGDD, the following mitigating circumstances exist in this case, which were not considered in the appropriate determination of the sanction:

- The defendant blocked the line as soon as it became aware of the facts (Article 83.2.c) of the GDPR);

- No special categories of data were processed at any time (Article 83.2.g) of the GDPR).

- ORANGE's cooperation with the Spanish Data Protection Agency (Article 83.2.f) of the GDPR) in order to remedy the alleged infringement and mitigate its potential adverse effects: it has been demonstrated that all requests for information from this Agency were answered in a timely manner.

- Adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved under Article 42 (Article 83.2.j of the GDPR).

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 37/54

- The non-existent benefit obtained by ORANGE as a result of the data processing that is the subject of this procedure. In any case, ORANGE has been harmed (Art. 83.2.k of the GDPR).

For all the above reasons, it requests that the procedure be dismissed, or that a warning be issued, and ultimately, that the sanction be reduced or modified.

None of the mitigating circumstances invoked are admissible.

The admission that the fact that the defendant blocked the line as soon as they became aware of the facts (Article 83.2.c of the GDPR) operates as a mitigating factor partially negates the deterrent purpose of the sanction. Accepting Orange's argument in a case like this would artificially reduce the sanction that should actually be imposed; the one that results from considering the circumstances of Article 83.2 of the GDPR, which must be taken into account.

Regarding Article 83.2.g) of the GDPR, ORANGE states that “No special categories of data have been processed at any time.”

The data processed by ORANGE is sensitive data, used to identify

its customers in the process of obtaining a duplicate e-SIM. This data includes
name, surname, and national identity document (DNI). This personal data is associated with a telephone line belonging to
a user, and its unauthorized access is particularly serious.

This is without prejudice to the fact that personal data such as the name, surname, and DNI of the account holder have been processed for the issuance of the duplicate e-SIM.

Article 83.2.f) of the GDPR refers to the “degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate its possible adverse effects.”

The respondent's reply to the information request from the Sub-Directorate of Inspection did not fulfill those purposes, and therefore cannot be classified as a mitigating circumstance.

Regarding the application of Article 76.2.c) of the LOPDGDD (Spanish Data Protection Law), in conjunction with Article 83.2.k) (non-existence of benefits obtained), it should be noted that this circumstance can only operate as an aggravating factor and in no case as a mitigating circumstance.

Article 83.2.k) of the GDPR refers to “any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.” And Article 76.2.c) of the LOPDGDD states that “2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account: [...] c) The profits obtained as a consequence of the commission of the infringement.” Both provisions mention, as a factor that may be taken into account in determining the penalty,

the “profits” obtained, but not the “absence” of these, which is what ORANGE alleges.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 38/54

Furthermore, in accordance with Article 83.1 of the GDPR, the imposition of fines is governed by the following principles: they must be individualized for each particular case, be effective, proportionate, and dissuasive. The admission that the absence of profits can operate as a mitigating factor is contrary to the spirit of Article 83.1 of the GDPR and to the principles governing the determination of the amount of the fine.

If, following the commission of a GDPR infringement, the absence of profits is considered a mitigating factor, the deterrent purpose of the penalty is partially nullified.
Accepting Orange's argument in a case such as this would introduce an artificial reduction in the penalty that should be imposed; the one that results from considering the circumstances of Article 83.2 of the GDPR, which must be taken into account.

The Administrative Chamber of the National Court has warned that the fact that, in a specific case, not all the elements constituting a circumstance modifying liability, which by its nature is an aggravating factor, are present, cannot lead to the conclusion that such a circumstance is applicable as a mitigating factor. The ruling made by the National Court in its Judgment of May 5, 2021 (Appeal No. 1437/2020)—even though that ruling deals with the circumstance of section e) of Article 83.2 of the GDPR, the commission of prior infringements—is applicable to the issue at hand: the defendant's claim that the "absence" of benefits should be accepted as a mitigating factor, given that both the GDPR and the Spanish Data Protection Act (LOPDGDD) refer only to "benefits obtained."

Thus, the proposed fine in this case (€230,000) falls within a range
significantly lower than the penalty range that could be imposed, which is established
between €0.00 and €172,479,960 for a company whose turnover
amounted to €4,311,999,000 in 2023.

IV. Response to the Allegations Submitted to the Proposed Resolution

The following is a response to the allegations submitted by TME,
which are, in general terms, a reiteration of those submitted to the initial agreement and

addressed in the proposed resolution, as reproduced in the
Legal Basis above.

PRELIMINARY.- REITERATION OF PREVIOUSLY SUBMITTED ALLEGATIONS

The respondent considers the allegations and

legal arguments presented in its previous submissions to be fully reproduced.

Regarding the aforementioned allegations raised by Telefónica, it is important to emphasize that these were already addressed in the preceding Legal Basis.

FIRST.- ON THE EXISTENCE OF ONGOING CRIMINAL PROCEEDINGS

With respect to the issue of criminal prejudiciality, ORANGE believes that the present sanctioning proceedings should be suspended until the criminal courts rule on the matter.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 39/54

In this regard, the information provided in the previous Legal Basis, in response to the objections raised at the commencement of proceedings, is relevant. It was noted that in this case, the required triple identity for suspending the administrative procedure due to its connection with the proceedings in the criminal jurisdiction is not present:

- The offending party would obviously not be the same – with respect to the GDPR infringements, the responsible party is ORANGE, while the criminally responsible party for any potential identity theft or fraud would be the third party who impersonated the claimant.





- Nor would the legal basis be the same: while the legal right protected
by the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) is the fundamental right to the protection of personal data, the
legal right protected in the criminal offenses whose commission would be investigated, should the

case arise, by the Investigating Court would be civil status, assets, etc.

In this regard, the Judgment of the National Court of
27/04/2012 (appeal no. 78/2010), already cited in the aforementioned Legal Basis III, is very enlightening.

In light of the foregoing, the issue raised by the

respondent cannot succeed and must be rejected.

SECOND.- ON THE FACTUAL BACKGROUND

In its second allegation, the respondent again reproduces the allegations and

legal arguments presented in its previous submissions.

This Agency reiterates in this respect what has already been stated in the proposed resolution and
reproduced in the preceding legal basis.

THIRD.- ON ORANGE'S ROLE AS VICTIM

In its third submission, the respondent reiterates the allegations and legal arguments presented in its previous submissions.

This Agency reiterates what was already stated in the proposed resolution and

reproduced in the preceding legal basis.

FOURTH.- ON THE INADMISSIBILITY OF STRICT LIABILITY

The respondent argues that the Agency's Initial Agreement is based
exclusively on a (brief) analysis of the outcome, considering that the issuance of
a duplicate SIM card resulting from a single manual error by an Agent
automatically implies that adequate measures were not taken and,
therefore, in the opinion of the Spanish Data Protection Agency (AEPD), automatically gives rise to direct liability

on the part of ORANGE.

Regarding ORANGE's conduct, it is considered to fall under the category of negligence.

As a repository of personal data on a large scale, and therefore accustomed to

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 40/54

or specifically dedicated to the management of customers' personal data, it must be especially diligent and careful in its processing. That is to say,
from the perspective of culpability, we are dealing with an avoidable error, since with the

application of appropriate technical and organizational measures, these identity thefts could have been prevented.

Recital 74 of the GDPR states: The controller's
responsibility for any processing of personal data carried out by the controller or on behalf of the controller must be established. In particular, the controller must

be obliged to implement appropriate and effective measures and must be able to demonstrate the
compliance of processing activities with this Regulation, including the
effectiveness of the measures. These measures must take into account the nature, scope, context, and purposes of the processing, as well as the risk to the rights and freedoms of natural persons. Recital 79 further states: The protection of the rights and freedoms of data subjects, as well as the responsibility of controllers and processors, including with regard to supervision by and measures taken by supervisory authorities, requires a clear allocation of responsibilities under this Regulation, including where a controller determines the purposes and means of processing jointly with other controllers, or where processing is carried out on behalf of a controller.

In this regard, it is important to recall Supreme Court ruling no. Judgment 188/2022, of February 15 (appeal no. 7359/2020), states in its fourth legal ground: “The fact that it was the

negligent action of an employee does not exempt her from her responsibility as
the person in charge of the correct use of the security measures that should have
guaranteed the proper use of the designed data recording system. As
we already held in Supreme Court Judgment no. 196/2020, of February 15, 2021 (appeal no. 1916/2020), the
data processor is also responsible for the actions of its employees and cannot
excuse itself based on its own diligent actions, separately from the actions of its

employees. Rather, it is the “culpable” actions of these employees, resulting from the violation
of existing security measures, that establish the company's liability in the area of sanctions for the “own” acts of its employees or officers, not
of third parties.”

The computer system and the technologies involved must be adequate to prevent identity theft and be properly configured.

This Agency does not agree with Orange's assertions regarding the established circumstances.

Regarding due diligence, it is acknowledged that Orange has acted diligently to minimize the impact on potential victims by implementing new security measures to prevent similar incidents from occurring in the future.

Indeed, the principle of liability established in Article 28 of the LRJSP (Law on the Legal Regime of the Public Sector)
stipulates that: “Only natural and legal persons, as well as, when a law recognizes their legal capacity, groups of affected parties, associations and entities without legal personality, and independent or autonomous assets, may be sanctioned for acts constituting an administrative offense, provided they are liable for such acts due to intent or negligence.”

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 41/54


However, the method of attributing liability to legal persons does not correspond to the forms of intentional or negligent culpability that are attributable to human conduct. Therefore, in the case of offenses committed by legal entities, although the element of culpability must be present, it is necessarily applied differently than it is with respect to natural persons.

According to Constitutional Court Ruling 246/1991, "(...) this distinct construction of the imputability of the authorship of the offense to the legal entity arises from the very nature of the legal fiction to which these subjects are subject. They lack the volitional element in the strict sense, but not the capacity to infringe the rules to which they are bound.

Capacity to infringe and, therefore, direct culpability derives from the legal interest protected by the rule that is infringed and the need for said protection to be truly effective, and from the risk that, consequently, the legal entity subject to compliance with said rule must assume" (in this sense, Supreme Court Ruling of November 24, 2011, Appeal No. 258/2009).

To the foregoing, it must be added, following the judgment of January 23, 1998,
partially transcribed in the Supreme Court judgments of October 9, 2009, Appeal No. 5285/2005, and of October 23, 2010, Appeal No. 1067/2006, that "although the culpability of the conduct must
also be subject to proof, it must be considered, in order to assume the
corresponding burden, that ordinarily the volitional and cognitive elements

necessary to assess it form part of the proven typical conduct, and that their
exclusion requires proof of the absence of such elements, or, in its
normative aspect, that the diligence required by the party alleging their
non-existence has been employed; in short, the mere invocation of the absence of culpability is insufficient for exoneration from conduct that is
typically unlawful."

Therefore, the claim of lack of culpability is dismissed. Ultimate responsibility
for the processing remains with the data controller, who determines the
existence of the processing and its purpose. It is worth recalling that, in general,
operators process their customers' data under the provisions of Article
6.1.b) of the GDPR, as this processing is considered necessary for the performance of a
contract to which the data subject is a party.

FIFTH.- ON THE CORRECT IMPLEMENTATION OF SECURITY MEASURES

5.1.- On the correct implementation of ORANGE's Security Policy

5.2.- On the position of the banking entities in the proceedings and the lack of

security measures established by them


5.3.- Additional security measures implemented by ORANGE

I. Measures implemented by ORANGE to prevent the commission of fraud

resulting from the impersonation of its customers.

II. Measures implemented by ORANGE to prevent fraud

derived from identity theft.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 42/54

SIXTH.- ON THE COMPLAINANT'S LACK OF DILIGENCE AND ORANGE'S

Regarding the aforementioned allegations raised by ORANGE, it is important to
emphasize that these were already addressed in the previous Legal Basis.

After questioning some of the facts and conclusions considered in the
proposed resolution, such as the non-compliance with its own
security protocols.

The preliminary investigation revealed the alleged issuance of

a duplicate SIM card to someone other than the cardholder. Three
failed attempts were made on February 4, 10, and 13, 2023, and the request was rejected
at a Jazztel point of sale. However, as mentioned, the request for a duplicate eSIM was ultimately successful
by telephone, with a third party bypassing the security policy

through Jazztel's customer service, impersonating the claimant. The Jazztel agent then activated the duplicate eSIM, bypassing
the identification measures and the Security Policy by asking
confidential questions. However, the agent who provided the card did not initially detect the alert in Jazztel's systems regarding previous attempts to obtain a duplicate, as Orange acknowledges in its response to this Agency, submitted on February 10, 2023, by the Fraud Department.

Therefore, the agent failed to detect the alert in the system, and thus, it proved insufficient to prevent the possibility of obtaining a duplicate after several fraudulent attempts had been identified.

Orange states that the Agency has not been able to prove that Orange was not due diligence in this case.

To this end, Orange, in its defense, refers to the set of security measures it has adopted, which are the minimum required of any organization with the characteristics and operating context of a telecommunications operator.

In short, the defendant cannot exonerate itself from responsibility by appealing

simply to the existence of minimal security measures and the deception to which
companies and their sales representatives are subjected by the impersonators.

Furthermore, it is incomprehensible that ORANGE is questioning facts that have been
sufficiently proven, even acknowledged by the company itself. Facts with

sufficient force to rebut the presumption of innocence.

The proceedings have established both the unlawful processing of data
and ORANGE's responsibility for carrying it out.

It is worth reiterating what was stated in the National High Court ruling of October 29, 2024, appeal no. 1824/2021, previously cited

which states that “…it must be emphasized, in relation to the technical and organizational measures, that we are not dealing with a merely formal requirement, but a substantive one. In this sense, and in line with what has been stated above, as the Supreme Court ruling 43/54 of February 15, 2022 (Appeal No. 7359/2020) points out:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
“It is not enough to design the necessary technical and organizational means; their correct implementation and appropriate use are also necessary, so that liability will also apply to the lack of due diligence in their use, understood as reasonable diligence considering the circumstances of the case,” which does not imply that an obligation of result is required.”

On these issues, we can only refer to the arguments presented in the previous legal basis, in response to the allegations made at the start of the proceedings, which are similar to those previously stated.

Furthermore, it should be noted that the error alleged to have been committed cannot in any way be considered to exclude liability, since, according to established case law, such an error cannot be deemed to exist when it is attributable to the party responsible or could have been avoided with greater diligence.

SEVENTH.- ON THE LACK OF PROPORTIONALITY OF THE PROPOSED SANCTION

In this regard, ORANGE points out:

In this sense, the following points should be highlighted, which, according to the Agency's interpretation, are considered aggravating factors, although the circumstances for their consideration in relation to the analyzed facts are not present:

• The nature and seriousness of the infringement (Article 83.2 a) of the GDPR). When

imposing this aggravating circumstance, consideration is given, in accordance with the provisions of
the Proposed Resolution, to the fact that the measures implemented were not
supposedly suitable to guarantee a level of security appropriate to the risk.

The infringement that occurred was isolated, contained, and not prolonged, and was

handled with remarkable diligence and speed. The fact that several impersonation attempts were thwarted demonstrates that the security measures and policies implemented were indeed sufficient to address attempted fraud.

• Intentionality or negligence in the infringement. Regarding the aggravating factor of intent or negligence, it should be noted that the infringement did not stem from a structural lack of diligence, but rather from a specific operational incident.

• The connection between the defendant's business activity and the processing of personal data of clients or third parties (Article 83.2.k of the GDPR in conjunction with Article 76.2.b of the LOPDGDD).

While it is true that ORANGE's business activities necessitate the processing of its customers' personal data, this factor is ambiguous in its assessment for inclusion as an aggravating circumstance, since this connection does not imply a direct relationship with the alleged infringement. Article 83.2 k) requires that this aggravating circumstance be linked to the specific facts of the case.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 44/54

Regarding these issues, we must again refer to the arguments presented in the previous legal basis, and they are dismissed as insufficient to refute the arguments put forward.

Furthermore, ORANGE reiterates its argument against the decision to initiate these proceedings concerning the existence of mitigating circumstances that were not considered in determining the penalty and which were already addressed in the proposed resolution. Thus, it considers that:

• The respondent blocked the line as soon as it became aware of the facts and notified the Complainant of what had happened (Art. 83.2 c).

• No special categories of data were processed at any time (Art. 83.2 g).

• The degree of cooperation from ORANGE with the Spanish Data Protection Agency (AEPD) in order to remedy an alleged infringement and mitigate its potential adverse effects: it has been demonstrated that all requests for information from this Agency were answered in a timely manner, in line with this company's usual practice of full cooperation with the data protection authority, as well as the restoration of the Complainant's situation to its original state (Art. 83.2 f).

• Adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved under Article 42 (Art. 83.2 j). In addition to the information already contained herein regarding the measures adopted by ORANGE to mitigate risks in SIM card duplication processes,

attached as Document No. 3 is the certificate issued by AENOR, which accredits that ORANGE has had an approved Regulatory Compliance System in place since September 4, 2023, that meets all the requirements of Article 31 bis of the Criminal Code, as well as the other compliance standards regarding crime prevention, such as Circular 1/2016, of January 22, from the State Attorney General's Office,

aimed at mitigating any risk of committing crimes within the framework of ORANGE's operations.

• The non-existent benefit obtained by ORANGE from the data processing that is the subject of this procedure. In any case, ORANGE has been harmed (Art. 83.2 k). In this case, as a contextual factor to consider, it is

important to highlight the absence of economic benefit for ORANGE, as this demonstrates that the infringement was not lucrative and did not generate a competitive advantage; on the contrary, it has been a harmed party as a direct consequence of a criminal act committed by a third party.

Regarding the mitigating circumstances invoked by ORANGE, these have already been rejected in the previous Legal Basis, to which reference should be made again.

ORANGE requests that the Agency suspend these proceedings, or alternatively,

dismiss the proceedings, or conclude the proceedings with a warning, and ultimately, adjust or reduce the sanction included in the proposed resolution.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 45/54

V. Breach of Obligation: Violation of Article 32 GDPR

The respondent is accused of committing an infringement by violating

Article 32 of the GDPR, “security of processing,” which states:

“1. Taking into account the state of the art, the costs of implementation, and the
nature, scope, context, and purposes of processing, as well as the risks of
varying likelihood and severity for the rights and freedoms of natural persons,

the controller and the processor shall implement appropriate technical and
organizational measures to ensure a level of security appropriate to the risk,
which may include, among other things:

(a) the pseudonymization and encryption of personal data;

(b) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of

processing systems and services processing;

c) the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident;

d) a process for regularly testing, assessing, and evaluating the effectiveness of the technical and organizational measures to ensure the security of the processing.

2. When assessing the adequacy of the level of security, particular consideration shall be given to the risks presented by the processing of data, in particular as a result of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

3. Adherence to an approved code of conduct pursuant to Article 40 or to an approved certification mechanism pursuant to Article 42 may serve as evidence of compliance with the requirements laid down in paragraph 1 of this Article.

4. The controller and the processor shall take measures to ensure that any person acting under the authority of the controller or the processor and having access to personal data only may process such data following
instructions from the controller, unless required to do so by Union or Member State law.”

Recital 74 of the GDPR states:

“The controller’s responsibility for any processing of personal data carried out by the controller or on its behalf should be established.

In particular, the controller should be required to implement appropriate and effective measures and should be able to demonstrate the conformity of processing activities with this Regulation, including the effectiveness of the measures. Such measures should take into account the nature, scope, context and purposes of the processing, as well as the risk to the rights and freedoms of natural persons.”

It should be noted that the GDPR, in the aforementioned provision, does not establish a list of the
security measures that are applicable according to the data being processed, but rather establishes that the controller and the processor
will implement technical and organizational measures appropriate to the risk involved in the processing, taking into account the state of the art, the costs of implementation, the
nature, scope, context and purposes of the processing, and the risks of likelihood
and severity for the rights and freedoms of data subjects.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 46/54

the processing.


C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es
46/54 Furthermore, security measures must be appropriate and proportionate to the identified risk. The determination of technical and organizational measures must take into account: pseudonymization and encryption; the ability to guarantee confidentiality, integrity, availability, and resilience; the ability to restore data availability and access after an incident; and the verification process (not an audit), evaluation, and assessment of the effectiveness of the measures.

In any case, when evaluating the adequacy of the security level, particular consideration will be given to the risks presented by data processing, such as the accidental or unlawful destruction, loss, or alteration of personal data transmitted, stored, or otherwise processed, or the unauthorized disclosure of or access to such data, which could cause physical, material, or immaterial damage.

In this same vein, Recital 83 of the GDPR states that:

“(83) In order to maintain security and prevent processing from infringing the provisions of this Regulation, the controller or the processor shall assess the risks inherent in the processing and implement measures to mitigate them, such as encryption. These measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the cost of implementation in relation to the risks and the nature of the personal data to be protected. When assessing the risk to data security, consideration should be given to the risks arising from the processing of personal data, such as the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed, which may in particular cause physical, material, or non-material damage.”

In the present case, as evidenced by the investigation, it appears that three failed attempts were made on February 4, 10, and 13,

2023, and one successful attempt was made on February 13, 2023, to duplicate the eSIM of the claimant.

The first attempt to duplicate the eSIM occurred on February 4,

2023, through a telephone request to Jazztel's customer service.

The eSIM duplication failed; the third-party impersonator bypassed the security policy by knowing the claimant's data (…), but failed validation because the token was missing, and the individual also failed to answer the confidential random questions, leaving the attempt pending validation.

The second attempt to duplicate the eSIM occurred on February 10, 2023, and was classified as fraudulent because a national identity document (DNI) with a manipulated photograph was used. Although the imposter
knew the claimant's basic information and financial institution, Jazztel opened

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 47/54

a fraud incident report, inserted a warning notice into its systems, detected the pending validation request dated February 4, 2023, and did not process it.

The third attempt occurred on February 13, 2023, and the request made at a Jazztel point of sale was also rejected.

However, on the same date, February 13, at 2:26 p.m., a third party made a telephone request for a duplicate eSIM, bypassing the security policy (…)
with a change of email address at 2:28 p.m. and eSIM delivery at 7:08 p.m.

Subsequently, Jazztel detected a fraud alert and blocked the eSIM and the caller's number on February 14, 2023, at 3:32 PM due to theft/loss. A notification was added to an internal list hours later to prevent future cases, along with an image of the manipulated ID card.

However, the agent who provided the card initially failed to detect the alert in Jazztel's systems, including the one from February 10, 2023, issued by the Fraud Department, and was reprimanded for this oversight. Consequently, reinforcement measures were implemented regarding these mandatory alerts to prevent recurrence. General training and guidelines were provided to frontline agents to ensure adherence to security protocols and policies for both in-person and remote requests.

Therefore, as Orange acknowledges in its response to this Agency,
it should be noted that Jazztel opened a fraud case and inserted a

warning notice into its systems on February 10, 2023, but the Jazztel customer service agent failed to detect the aforementioned warning related to the complainant's phone number.

In this regard, it can be observed that a mere system notification is insufficient to prevent the possibility of obtaining a duplicate SIM card after
several fraudulent attempts have been identified. In such cases, the impossibility of obtaining a duplicate should be effectively guaranteed,

if necessary, even by blocking the
ability to issue a duplicate SIM card.

It should be noted that this is not a specific incident involving
the complainant, but rather a general weakness in Orange's security policy. It is necessary to implement additional measures that go beyond

verifying the identity of the SIM card applicant. This type of processing
requires proper verification of the applicant's identity, and for this, it is
necessary to establish measures that ensure correct identification. This also
includes adopting measures that, in situations of proven risk, allow for
guaranteeing data security. These measures must be effective and enable

the data controller to enforce them.

Issuing duplicate e-SIMs requires greater diligence in the protection of
personal data, based on the proactive principle of Article 24 of the GDPR.

This principle obliges organizations to act in a way that anticipates and

mitigates risks to the personal data that will be processed. Since the
e-SIM contains sensitive information that identifies the data subject, it is crucial to verify the
identity of the QR code recipient. The lack of proper verification, such as sending the QR code to an email address without further checks, demonstrates

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 48/54

a failure to apply this principle and jeopardizes the security of
personal data. Consequently, the issuance of duplicate eSIMs should
incorporate additional proactive measures to guarantee the identification of

their holder and, in this way, protect the rights of data subjects.

The non-compliance with Article 32 of the GDPR is also evidenced by the fact that,
despite several previous failed attempts at identity theft, a duplicate eSIM was ultimately issued to the detriment of the claimant. This incident would demonstrate a
deficiency in the implementation of the security measures adopted and

implemented by the respondent.

Article 32 stipulates that the data controller must adopt security measures appropriate to the risk. However, in this case, the system allowed the third party,
after multiple fraud attempts (on February 4, 10, and 13, 2023), to finally

overcome the security policy on February 13. Although the initial attempts were detected and classified as fraudulent, and warning notices were
inserted into the system, these proved insufficient to stop the final successful attempt, suggesting a lack of effectiveness in the measures
adopted.

These events expose a presumed vulnerability in the security system, as the respondent failed to adequately anticipate or strengthen its validation mechanisms despite the initial impersonation attempts. Issuing a duplicate eSIM despite prior alerts would reflect either a lack of effective controls or a lack of a prompt and diligent response after failed attempts.

This would demonstrate that the security measures are not adequately addressed by risks such as unauthorized access, thus compromising the protection of users' personal data.

Based on the above, in the case analyzed, the security measures implemented by Orange to prevent these incidents are called into question, proving insufficient.

In this regard, Recital 40 of the GDPR states:

“(40) For processing to be lawful, personal data must be processed with the data subject’s consent or on some other legitimate ground established in accordance with the law, whether in this Regulation or under other Union or Member State law to which this Regulation refers, including the need to comply with a legal obligation to which the controller is subject or the need to perform a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract.”

VI. Classification of the infringement of Article 32 of the GDPR and classification of the infringement for

statute of limitations purposes

The infringement of Article 32 is classified in Article 83.4 of the GDPR, which considers the following as such:

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 49/54

“Infringements of the following provisions shall be sanctioned, in accordance with paragraph 2, by administrative fines of up to EUR 10,000,000 or, in the case of an undertaking, up to 2% of its total worldwide annual turnover of the preceding financial year, whichever is higher:
a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39, 42 and 43; (...).”

For the purposes of the statute of limitations for this infringement, the LOPDGD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) classifies in its Article 73 as a

serious infringement, in which case the statute of limitations is two years, “(f) The failure to adopt the appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the processing, as required by Article 32.1 of Regulation (EU) 2016/679.”

VII. Fine. Determination of the Amount

Determining the appropriate penalty in this case requires
compliance with the provisions of Articles 83.1 and 83.2 of the GDPR, which,

respectively, stipulate the following:

“1. Each supervisory authority shall ensure that the imposition of administrative fines under this Article for infringements of this Regulation referred to in paragraphs 4, 9 and 6 is, in each individual case,

effective, proportionate and dissuasive.”

“2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as an alternative to the measures provided for in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due consideration shall be given to:

(a) the nature, seriousness, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered by them;

(b) the intent or negligence of the infringement;

(c) any measures taken by the controller or processor to mitigate the damage suffered by the data subjects;

(d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures implemented by them pursuant to Articles 25 and 32;

(e) any prior infringements committed by the controller or processor processing;

f) the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate its possible adverse effects;

g) the categories of personal data affected by the infringement;

h) how the supervisory authority became aware of the infringement, in particular whether and, if so, to what extent the controller or processor notified the infringement;

i) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures;

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 50/54

j) adherence to codes of conduct pursuant to Article 40 or to approved certification mechanisms pursuant to Article 42; and
k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.

Within thisIn this section, the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) addresses in Article 76, entitled "Sanctions and Corrective Measures":

"1. The sanctions provided for in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity of the sanction established in paragraph 2 of the aforementioned article.
2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account:
a) The ongoing nature of the infringement.
b) The connection between the infringer's activity and the processing of personal data.

c) The benefits obtained as a result of committing the infringement.
d) The possibility that the data subject's conduct may have induced the commission of the infringement.

e) The existence of a merger by acquisition subsequent to the commission of the infringement, which cannot be attributed to the entity." absorbing.

f) The impact on the rights of minors.

g) Appointing a data protection officer, where not mandatory.

h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in cases where disputes arise between them and any data subject.

3. It will be possible, either as a complement or alternative, to adopt, where appropriate,

the remaining corrective measures referred to in Article 83.2 of Regulation (EU) 2016/679.

In accordance with the aforementioned provisions, for the purpose of determining the amount of the penalty to be imposed in this case for the infringement defined in Article 32.1 of the GDPR, and defined in Article 83.4(a) of the GDPR, for which the defendant is responsible, the following factors are considered to be present:

- The nature and seriousness of the infringement; The facts revealed
affect an essential element of the processing of personal data, namely its security; it must be considered that
the measures implemented were not suitable to guarantee a level of
security appropriate to the risk, which led to the loss of confidentiality,

integrity, and control over personal data; measures that were not
appropriate; measures that are key to guaranteeing the fundamental right
to data protection and whose infringement is severely sanctioned by the law; to the above, we must add the level of damages
suffered, since the breach of the implemented measures enabled

access to the personal data of a client of the entity (Article
83.2.a) of the GDPR).

- The intent or negligence in the infringement. Although it cannot be
considered that it acted with intent or malice, a lack of

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 51/54

diligence is observed in complying with the obligations imposed on it by the regulations on
data protection, such as compliance with and implementation
of the appropriate technical and organizational measures to guarantee a level of

security appropriate to the risk in the processing it carries out; in this
respect, the SAN ruling of 17/10/2007 can be cited, which, although issued before
the GDPR came into force, its pronouncement is perfectly applicable to the
case we are analyzing. The ruling, after alluding to the fact that entities

whose business activities involve the continuous processing of
customer and third-party data must observe an appropriate level of diligence,

specified that “(...) the Supreme Court has consistently held that negligence exists
whenever a legal duty of care is disregarded, that is,

when the offender does not act with the required diligence. And in assessing
the degree of diligence, special consideration must be given to the professionalism or lack thereof
of the individual, and there is no doubt that, in the case now under examination, when the

appellant's activity involves the constant and extensive handling of personal data,
it is essential to emphasize the rigor and meticulous care required to comply
with the relevant legal provisions.” (Article 83.2.b) of the GDPR).

However, the infringing conduct cannot be considered to constitute a serious lack of due diligence, since it was only after several attempts that the

usurper managed to circumvent the security policy, and once the
duplicate SIM card was issued, the controls implemented by Orange alerted them to the
possible fraud. These circumstances must be taken into account when determining the
penalty.

Furthermore, the following aggravating circumstance is considered:

- The activity of the allegedly infringing entity is linked to
the processing of personal data of both clients and third parties.

The processing of

personal data is essential to the activity of the entity being complained against; therefore, given its purpose and volume of business, the
significance of the conduct that is the subject of this complaint is undeniable

(Article 76.2.b) of the LOPDGDD in relation to Article 83.2.k).

For the purposes of deciding on the imposition of the fine and its amount, in accordance with the available evidence and taking into account the criteria of Article 83.2 of the GDPR regarding the infringement committed, a violation of Article 32.1 of the GDPR, a penalty of €230,000 is deemed appropriate.

VII. Corrective Measures

The corrective powers that the GDPR grants to the Spanish Data Protection Agency (AEPD) as the supervisory authority are set out in Article 58.2, paragraphs (a) to (j).

Should the infringement be confirmed, it would be appropriate to order the responsible party to adopt
appropriate measures to bring their actions into compliance with the regulations mentioned
in this document, in accordance with the provisions of Article 58.2 d) of the GDPR,
according to which each supervisory authority may “require the controller or processor
to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period…”.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 52/54

The imposition of this measure is compatible with the sanction
consisting of an administrative fine, as provided for in Article 83.2 of the GDPR.

Therefore, it would be considered appropriate to order the respondent, within six months of the finality of the sanctioning resolution, to adapt the processing activities subject to this procedure to the applicable regulations. The text of this agreement establishes the facts that allegedly gave rise to the breach of data protection regulations, from which it is clear what measures should be adopted. However, the specific procedures, mechanisms, or instruments for implementing these measures are the responsibility of the respondent, as they are the ones who fully understand their organization and must decide, based on proactive responsibility and a risk-based approach, how to comply with the GDPR and the LOPDGDD. However, in the present
case, among other measures to be adopted are those of a technical and

organizational nature to prevent incidents such as the one that occurred, guaranteeing the principle of
confidentiality and security in the processing of data in accordance with
Article 32.1 of the GDPR.

It is advised that failure to comply with the possible order to adopt measures imposed by
this body in the sanctioning resolution may be considered an

administrative infringement in accordance with the provisions of the GDPR, classified as an
infringement in Articles 83.5 and 83.6, and such conduct may lead to the initiation of
further administrative sanctioning proceedings.

In light of the facts presented, it is considered appropriate to impose a sanction on

the respondent for the violation of Article 32 of the GDPR, classified in Article
83.4 of the GDPR. The applicable sanction is an administrative fine of €230,000.

Therefore, in accordance with applicable legislation and having assessed the criteria for

graduating the sanctions, the existence of which has been proven,

the President of the Spanish Data Protection Agency RESOLVES:

FIRST: TO IMPOSE on ORANGE ESPAGNE, S.A.U., with Tax Identification Number A82009812, for an
infringement of Article 32 of the GDPR, classified under Article 83.4 of the GDPR, a fine
of €230,000 (two hundred and thirty thousand euros).

SECOND: ORDER ORANGE ESPAGNE, S.A.U., with Tax Identification Number A82009812, to, pursuant to Article 58.2.d) of the GDPR, within a maximum period of six months from the date this resolution becomes final and enforceable, demonstrate that it has complied with the following:

among other measures, technical and organizational measures to prevent incidents such as the one that occurred, guaranteeing the principle of confidentiality and security in the processing of data in accordance with Article 32.1 of the GDPR.

SECOND: NOTIFY ORANGE ESPAGNE, S.A.U. of this resolution.

THIRD: This resolution will become enforceable once the period for filing an optional appeal for reconsideration (one month from the day following notification of this resolution) has expired without the interested party having exercised this right.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 53/54

The sanctioned party is hereby notified that they must pay the imposed penalty once this resolution becomes enforceable, in accordance with the provisions of Article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in Article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to Article 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP). 62 of Law 58/2003, of December 17, by depositing the sanctioned party's Tax Identification Number (NIF) and the procedure number shown in the heading of this document into the restricted account IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX), held in the name of the Spanish Data Protection Agency at CAIXABANK, S.A. Otherwise, collection will be initiated during the enforcement period.
... Upon receipt of the notification and once it becomes enforceable, if the enforceability date falls
between the 1st and 15th of each month, inclusive, the deadline for making the voluntary payment will be the 20th of the following month or the next business day thereafter, and if it falls

between the 16th and the last day of each month, inclusive, the payment deadline will be
the 5th of the second following month or the next business day thereafter.

In accordance with the provisions of Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), this
Resolution will be made public. Publication will take place once it has been notified to
the interested parties.

This resolution, which concludes the administrative process pursuant to Article 50 of the LOPDGDD, may be appealed. 48.6 of the
LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the
interested parties may, optionally, file an appeal for reconsideration with the
Presidency of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly

file an administrative appeal with the Administrative Chamber of the
National Court, pursuant to the provisions of Article 25 and paragraph 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Administrative Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the

said Law.

Finally, it is noted that, in accordance with the provisions of Article 90.3 a) of the LPACAP, a
final administrative decision may be provisionally suspended if the
interested party expresses their intention to file an appeal with the Administrative Court.

If this is the case, the interested party must formally communicate this fact by means of a written communication addressed to the Spanish Data Protection Agency, submitting it through

the Agency's Electronic Registry [https://sedeaepd.gob.es/sede-electronica-
web/], or through one of the other registries provided for in Article 16.4 of
Law 39/2015, of October 1. They must also provide the Agency with the
documentation that proves the effective filing of the appeal with the Administrative Court.

If the Agency is not notified of the filing of the appeal within two months from the day following the
notification of this resolution, the provisional suspension will be terminated.

Lorenzo Cotino Hueso

6 Jorge Juan Street www.aepd.es
28001 – Madrid sedeaepd.gob.es 54/54

President of the Spanish Data Protection Agency

6 Jorge Juan Street www.aepd.es
28001 – Madrid sedeaepd.gob.es