AEPD (Spain) - EXP202307361

AEPD - EXP202307361
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1) GDPR Article 24 GDPR Art. 75 LPACAP
Type:	Complaint
Outcome:	Upheld
Started:	17.04.2023
Decided:	21.05.2025
Published:	08.07.2025
Fine:	200,000 EUR
Parties:	TELEFÓNICA MÓVILES ESPAÑA, S.A.
National Case Number/Name:	EXP202307361
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	ap

The DPA fined a telecommunications company €200,000 for issuing a duplicate e-SIM card to an unauthorised person without a valid legal basis.

English Summary

Facts

TELEFÓNICA MÓVILES ESPAÑA, S.A. (the controller) is a telecommunications provider. One of the brands provided is O2, which the data subject has a contract with. On 16 January 2023, the controller received a request to duplicate the e-SIM card of the data subject by a third person. The controller processed the request, which left the data subject without service. The data subject contacted the controller and was informed of the e-SIM duplicate. After going to one of the controller’s physical stores, the data subject was also informed that a third person had requested the duplicate by e-mail.

The controller argued that it had no record of the e-mail sent by the third person. In addition, the controller argued its security measures were sufficient at the time, and that it added measures following the unauthorised e-SIM duplication. Finally, the controller stated that its security measures were not followed by the sales agent, who was required to make a security call.

The data subject filed a complaint with the DPA on 17 April 2023. The DPA began sanctioning proceedings against the controller on 21 May 2024. The controller objected to the DPA’s sanctioning proceedings, arguing that the incident is still subject to criminal proceedings. Under Spanish administrative law, the issue must first be resolved criminally before it is resolved administratively.

Holding

The DPA first dismissed the controller’s objection to the proceedings. National administrative law binds public bodies to facts declared proven by final criminal court rulings. However, the DPA considered that the criminal and administrative cases were separate enough: for example, the controller was responsible for violations of the GDPR and national data protection law, while the third person was responsible for potential crimes of identity fraud.

The DPA then found a violation of Article 6(1) GDPR, as there was no a valid legal basis for the processing of personal data to duplicate the e-SIM card for an unauthorised person. The controller could not rely on the consent of the data subject, or any of the legal bases under Article 6(1) GDPR.

The DPA noted that the controller did not follow the needed precautions to prevent the third person from accessing a copy of the e-SIM, including following its own security measures. The controller issued the e-SIM duplicate despite the third party providing an email address different to the data subject’s, and did not carry out additional calls for security reasons. According to the DPA, issuing e-SIM duplicates requires more diligence on the controller’s behalf, in accordance with Article 24 GDPR.

The DPA fined the controller €200,000 for issuing the e-SIM duplicate without the knowledge or consent of the data subject. The DPA considered this a serious violation, as it was the third time it fined the controller for the same violation (the previous two fines being €70,000 each). In addition, the DPA took into account the fact that the controller processes large amounts of personal data on a daily basis, which demands higher rigor when ensuring the protection of personal data in accordance with national case law.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

1/44

 File No.: EXP202307361

SANCTIONING PROCEDURE RESOLUTION

From the procedure initiated by the Spanish Data Protection Agency and based

on the following

BACKGROUND

FIRST: Mr. A.A.A. (hereinafter, the complainant) filed a complaint with the Spanish Data Protection Agency on April 17, 2023. The complaint is directed against the O2 brand of TELEFÓNICA MÓVILES ESPAÑA, S.A.
with NIF A78923125 (hereinafter, the respondent or TME). The grounds for the claim are as follows:

The complainant states that on January 15, 2023, a third party made a duplicate SIM card for their telephone line, ***TELÉFONO.1, without their consent. During this process, the complainant did not receive any information or confirmation of any kind on their terminal or on any of the other numbers in their contract.

They add that on January 16, 2023, after noticing that they had lost service, they contacted customer service and learned what had happened, but were not offered any solution at that time. A day later, on January 17, 2023, they went to a physical TME store in ***LOCALIDAD.1 to recover their line, where they were informed that a third party with the email address "***EMAIL.1," not linked to their contract, had requested a duplicate the previous day.

He states that the person who made the aforementioned duplicate committed various frauds in various businesses using his bank account.

And he provides the following documentation:

- Report to the National Police of (...) dated January 17, 2023.
- Report to the National Police of (...) dated January 20, 2023.
- O2 fiber and mobile telecommunications service contract dated August 16, 2022.
- Certificate issued by WiZink Bank S.A.U. on January 14, 2023,
indicating the online transactions carried out on January 16 and 17, 2023, with the card the entity issued in the claimant's name.

SECOND: In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), this complaint was forwarded to the respondent so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements set forth in the data protection regulations.

The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was recorded on June 5, 2023, as recorded in the acknowledgment of receipt included in the file.

On July 4, 2023, this Agency received a response letter stating:

"In relation to the reported incidents, Telefónica informs that there is a request for a SIM card change associated with the mobile line ***TELÉFONO.1, owned by D. A.A.A., through our customer service line at 1551. This request is being processed given that the request did meet the necessary requirements in accordance with the established procedures for such purposes, and therefore our agent is acting correctly. In this case, the request for a duplicate is in E-SIM format. In this regard, it should be noted that, in the aforementioned procedure, for a duplicate to be sent via E-SIM by email, the requesting cardholder must provide the following information: - National Identity Document number
- Full name and surname - Mobile phone number of the person requesting the card change

- Email address that appears in the customer's file - You must provide the last 4 digits of the code from the last invoice.

In this case, given that the request met and complied with all the requirements outlined above, the E-SIM was sent to the registered email address.

Therefore, if the facts reported by the claimant were consistent with those of possible fraud or criminal conduct, it should be noted that the alleged fraudster had all the line details detailed above in advance.

At Telefónica, and once the claim was received, we proceeded to conduct a thorough analysis of what happened. We found that, on January 16, 2023, when the request for a duplicate SIM card was made using number 1551, the email address had previously been changed through the customer's O2 account via the Mobile App.

This access (change of contact email) occurred on January 13, 2023. January

2023 without any incident. In other words, it was accessed with complete ease, without the use of brute force, which may lead us to suspect that the potential fraudster knows all the login details to the customer's private account.

In this case, as we mentioned, access to the customer's account was achieved without any incident or error, on the first attempt. This means that the security measures implemented by O2 have not been breached. Therefore, we understand that the email change made through the claimant's account is a legitimate change.

From Telefónica, and given the circumstances surrounding the case, we inform the Agency that, once we became aware of the incident, we proceeded to address the claimant's claim. In this regard, we must mention that, on the invoice issued on March 1, 2023, the refund was made for

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/44

the 14.50 euros (VAT included) paid by the line owner to obtain the new SIM card."

In its response to the complaint transfer process, TME did not provide any documentation as proof of its statements.

THIRD: On July 17, 2023, in accordance with Article 65 of the LOPDGDD (Spanish Data Protection Act), the complaint filed by the complainant was admitted for processing.

FOURTH: The Subdirectorate General of Data Inspection proceeded to carry out preliminary investigations to clarify the facts in question, pursuant to the functions assigned to supervisory authorities in Article 57.1 and the powers granted in Article 58.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and in accordance with the provisions of Title VII, Chapter I, Section Two, of the LOPDGDD (Spanish Data Protection Act), having learned of the following:

On September 4, 2024, this Agency received the response from TME to the request for information sent to it by the Inspection Services. In this response, the aforementioned entity states the following:

POINT 1. The respondent indicates that, after reviewing its systems, there is no record of the request for a duplicate SIM card made by telephone.
It indicates that, however, since the request arose from a previous email request that referred the request to 1551 (by phone), there is a record of the commercial agent in the customer's file detailing that the request is being processed, since the applicant sent an email with the documentation regarding the DNI, full name, and the mobile phone number for which the request is being processed.

TME attaches as Annex 1 a copy of an email sent from the address "***EMAIL.1", as well as the response email sent by an operator agent.
The content of both emails is noted in the Second Proven Fact, although the date of either of them is not specified in the document provided.

In the procedure outlined by the entity for the claim, it indicated that in order to send a duplicate E-SIM via email, the requesting cardholder must provide the following information:
- National Identity Document (DNI) number.
- Full name and surname.

- Mobile phone number of the person requesting the card change.
- Email address shown on the customer's information sheet.
- The last four digits of the code on the most recent invoice must be provided.

The respondent states that, with respect to the security call, it did not occur since the documentation was sent via email, and that, notwithstanding the foregoing, the commercial agent did not follow the procedure outlined for this purpose regarding the security call, which should have been made since the request came from an email address other than the one listed in the customer file.

POINT 2. The respondent has been asked for information on whether the procedure includes additional checks when an E-SIM is requested and the customer's email address has recently changed. Documentation proving that additional checks were performed, if applicable, has been requested.

The representative of the respondent indicates that, at the time of the events, in the specific cases of E-SIM requests, the usual identification procedures were followed, as if it were a case of a duplicate SIM card in physical format. He states that, for these types of requests, it must be verified that the E-SIM card is sent to the email address listed in their systems on the customer's file.

TME, dated September 4, 2023, in response to this Agency's request for information dated August 17, 2023, states: "Regarding the specific case, although it can be seen, as reflected in the documentation attached as Annex 1, that the documentation was sent by email,

there is no record that the E-SIM was sent to the email address listed on the complainant's customer file."

He emphasized that operations have currently been strengthened, since whether for email changes or SIM card duplication, if a customer calls from a number other than the one being requested or writes from an email address other than the one listed as validated, an OTP code is sent to the line in question as a two-factor authentication, which must be provided to the sales agent as an essential requirement to proceed with the process.

For clarification, it should be noted that an OTP code, or "One-Time Password," is a password that is used only once to authenticate a user during a specific session or transaction. OTPs can be generated in several ways: through a mobile authentication app, a specific hardware device, or through SMS messages or emails.

POINT 3. The respondent has been asked to provide a copy of the instructions available to the staff who handle telephone requests for SIM and E-SIM duplicates.

The entity's representative provided the version of the instructions in force at the time of the events. The AEPD inspector verified that these instructions did not cite any specific information for E-SIM duplicates.

The entity's representative stated that in the specific cases of E-SIM requests, the usual identification procedures were followed, as if it were a case of a physical SIM duplicate. He indicated that, additionally, for these types of requests, it must be verified that the E-SIM card is sent to the email address registered in the entity's systems.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 5/44

The AEPD inspector verified that the instructions in place at the time of the events stipulate the issuance of a duplicate SIM card. These instructions,
according to the documentation provided by TME, indicate the following regarding card duplicates and ICC (SIM identification code) changes:

“- The applicant must be the cardholder.
- Must provide:
. First and last name
. Tax ID
. Last digits of the last O2 invoice number

. For terminations due to death or disability, see procedure
- If the call is made from the account number, the call will not be received.
- If the call is not made from the account number, once identified, tell the customer that you are hanging up
for verification purposes, and place a call to the account holder's number (see all OK).
- Whether this call is answered or not, an email will be sent to the account holder's contact email to notify them of any changes.
- The verification is completed, and the customer will be called back to the number of their choice
to complete the transaction.”

They provide a copy of instructions that they call "reinforcement" (new instructions following the reported events), stating that they have currently been established regarding the aforementioned operation. They indicate that in the case of a "call from an unknown phone" or "contact from another EMAIL"  "the account holder must be called / and an OTP must be sent for verification"  "The account holder must approve the call and confirm with an OTP."

POINT 4. The respondent has been required to provide a list and details of

all contacts with the customer between January 12, 2023, and January 18, 2023, including notes made by the telephone/chat/email/etc. support managers, and documentary evidence of the actions taken in each contact.

The representative of the respondent states that on January 13, 2023, the aforementioned email was received requesting a duplicate card for the affected line.
The response was forwarded to 1551 for processing. The representative states that later, on January 16, 2023, a person called at 2:10 p.m. to request a duplicate card, in which they allegedly indicated to the sales agent that they had previously provided their ID documentation by email.
After this, the sales agent, upon verifying these facts, ended up processing the duplicate E-SIM. They indicate that this call was not recorded.

TME, dated September 4, 2023, in response to this Agency's request for information dated August 17, 2023, provides the following entry in the customer's file, dated January 16, 2023 (2:10 p.m.): "Complaints

for a duplicate E-SIM for line […], documentation sent is confirmed […] I am processing it."

The representative of the respondent states that there is evidence of telephone contact from the customer on the same day, January 16, 2023, at 6:41 p.m., because they did not have service, and that the call was blocked due to theft. They indicate that the call was not recorded, providing a record of the contact.

In conclusion, the AEPD inspector, in his preliminary investigation report dated March 26, 2023, states:

It has been shown that the duplicate SIM card subject to the complaint was an E-SIM (electronic SIM).

It has been shown that the duplicate E-SIM card was issued and activated despite having been requested from a different email address than the one registered for the customer in the entity's systems, without performing additional security checks, such as a verification call to the cardholder. The QR code was sent to that email address, which was different from the one registered for the customer. The representatives of the respondent state that an additional verification call was stipulated in the entity's security policy and that the agent who processed the request failed to comply with it. However, it has been shown that this verification call was only mentioned in the security policy in the event that the applicant called from another number, and it did not explicitly specify how to proceed in the event of receiving emails from another address.

They have now modified their security policy, including the verification call (or verification by sending an OTP to the customer) also in the event of receiving an email from another address.

FIFTH: According to the report collected from the AXESOR tool, the entity
TELEFÓNICA MÓVILES ESPAÑA, S.A.U. It is a large company established in 1988, with a turnover of (...) euros in 2022.

SIXTH: On May 21, 2024, the Director of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against the respondent, in accordance with the provisions of Articles 63 and 64 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged violation of Article 6.1 of the GDPR, classified in Article 83.5 of the GDPR.

SEVENTH: After notification of the aforementioned initiation agreement in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), the respondent filed a written statement of allegations on June 17, 2024, stating the following:

PRIOR CLAIM. - CRIMINAL PREJUDICIALITY

First, Telefónica indicates that the Claimant filed a complaint with the State Security Forces and Corps on January 17, 2023, as well as on January 20, 2023, in relation to the same facts that are being discussed in these proceedings. Therefore, it requests the Agency "to suspend the sanctioning procedure and request the Complainant to provide information regarding the status of the complaint filed, as well as the content of any ongoing criminal proceedings. It may, if appropriate, agree to suspend this procedure due to a criminal pre-trial proceeding, given the close relationship that, as this party already states, likely exists between the criminal and administrative proceedings."

I. ON THE FACTS THAT GIVE RISE TO THE INITIATION OF THIS AGREEMENT TO INITIATE THE SANCTIONING PROCEDURE

FIRST. - NO INFRINGEMENT. DISAGREEMENT

WITH THE AGREEMENT TO INITIATE THE SANCTIONING PROCEEDING

Telefónica expresses its complete disagreement with the initiation of this sanctioning procedure and with the provisions of the alleged proven facts included in the grounds of the Agreement, indicating that, from the responses made by

the respondent party to the requests for information made by the Agency, in
no case can it be inferred that they imply admission, presupposition, or verification by
the Agency that the commercial agent did not follow the procedures related to customer identification.

Telefónica points out that there is no evidence of sufficient weight to overcome Telefónica's presumption of innocence that would prove the lack of verification of the identity of the person who requested the duplicate E-SIM card, nor would it prove the failure to apply the safeguards provided for.

In this regard, the respondent points out the technical and organizational measures implemented by Telefónica that are appropriate for the management of the matters resulting from this Agreement, that is, duplicate SIM or E-SIM cards and, specifically, their processing under the "O2" trademark, given that it is the trademark under which the mobile services subject to this proceeding are provided.

In this regard, Telefónica indicates that, in accordance with its operational procedures, identity checks had to be carried out, given that it has a well-established and adequate procedure for verifying the identity of its customers that provides sufficient guarantees to identify the applicant for the duplicate E-SIM card, and the Agency has not been able to prove, through sufficient evidence, that this was not the case. The lack of a copy of the contract does not mean that the identification was not carried out correctly.

II. THE CIRCUMSTANCES THAT MADE IT POSSIBLE FOR THIRD PARTIES TO OVERCOME THE SECURITY POLICIES IMPLEMENTED

BY TELEFÓNICA.

FIRST. - REGARDING THE ALLEGED INFRINGEMENT COMMITTED BY TELEFÓNICA: LACK OF TYPICALITY, UNLAWFULNESS, AND GUILT.

It considers that the principle of criminality is being violated given that the conduct carried out by Telefónica is not subsumed under any of the provisions alleged to have been violated.

It notes that the Agency considers Article 6.1 of the GDPR (conditions under which processing will be considered lawful) to have been violated and classifies the violation in accordance with Article 83.5 of the GDPR. However, the Agency does not mention which of the legitimate grounds set forth in Article 6.1 would be necessary to carry out the processing of the complainant's data that gave rise to this Agreement, so that it could be considered lawful.

The respondent points out that the legal basis legitimizing the processing of the claimant's personal data is none other than the performance of the contract, that is, the legal basis contemplated in section b) of the aforementioned article 6.1: "the processing is necessary for the performance of a contract to which the data subject is a party or for the application, at the request of the data subject, of pre-contractual measures."

It indicates that in this specific case, the processing of personal data is carried out for the purpose of managing a duplicate E-SIM card for the correct provision of the service, or, in other words, to be able to execute the contract that the claimant has signed with Telefónica. Therefore, the processing is lawful in any case.

“TME” considers that it has acted at all times in good faith and with a well-founded belief,
excluding any culpability, and points out that the unlawfulness of the conduct is a defining element of any administrative offense; it requires, in its formal aspect or form, that there be a contrast between the behavior and the rule violated.

Therefore, if the behavior is supported by the legal system, it can never be considered unlawful conduct nor, therefore, punishable. Thus, “TME”
rejects the unlawfulness of the conduct.

SECOND. –LACK OF GUILT. ERROR OF TYPE.

"TME" points out that the requirement of culpability in its actions is not met, as the principles inspiring criminal law are applicable to administrative sanctioning law. It points out that one of the main components of an administrative offense is culpability, which presupposes that the action or omission must in any case be attributable to its perpetrator due to malice, recklessness, negligence, or inexcusable ignorance, requirements that are not met in this case. Therefore, even if the Agency considers that there has been unlawful data processing on this part, considering that Telefónica's action is typical and unlawful, in no case can it be said that the conduct followed by Telefónica can be considered culpable. Likewise, it states that the processing of the E-SIM duplicate was allegedly carried out in any case as a result of acts of deception, manipulation, and illicit use of data by a third party, who deceived the sales agent into believing that they were the data owner or that they had their consent to make the request, having correctly identified themselves with the customer data contained in their systems.

It points out that, in this case, where, according to operational procedures, the customer had identified themselves with the correct data for the SIM card duplicate request, it has been established that this would be an insurmountable error, where the unlawfulness of the conduct was unknown, and the proceedings should be closed, as Telefónica's culpability cannot be determined.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/44

THIRD. – ON THE CRITERIA FOR GRADUATING THE PENALTY

“TME” expresses its disagreement with the amount of the penalty proposed in the

Initiation Agreement, pointing out the following aspects:

The Agency considers the following circumstance to aggravate Telefónica's conduct:

“The evident link between the business activity of the respondent and the

processing of personal data of clients or third parties (Article 83.2.k of the GDPR in relation to Article 76.2.b of the LOPDGDD).”

“TME” considers that there has been no unlawful processing of the complainant's data, since its processing is legitimized by Article 6.1 of the GDPR, and is necessary for the execution of a contract to which the data subject is a party. Therefore, it cannot be considered an aggravating circumstance.

It also indicates that the Agency de facto considers that, given that "TME" handles a high volume of data processing, this aggravating circumstance should be applied.

Furthermore, it points out the circumstance of Article 83 2.e) GDPR, with the Agency expressly mentioning the sanctioning procedures EXP202207989 and EXP202211479.

It points out that both sanctioning resolutions became final after the typical action prosecuted in this sanctioning case, which stems from an act that occurred on January 16, 2023, that is, prior to the aforementioned sanctioning resolutions.

It indicates that it is entirely logical that, if we are talking about an individual case, the

sanction should be tailored to that specific case, and not to a kind of joint sanction
which takes into account similar cases in which a sanction may have been imposed on Telefónica for an alleged violation of Article 6.1 of the GDPR.

“TME” cites in its defense a series of resolutions issued by the AEPD,
stating that EXP20210446 was closed due to the understanding that

there was already a sanctioning procedure underway for the same facts and that Telefónica
has already been sanctioned for the same facts currently being developed in the procedure.
The Agency imposed the sanction through the procedure with reference
PS/00021/2021 and therefore violates the non bis principle.

“TME” points out that in the present case, the following mitigating circumstances of Article 6.1 apply: 83.2 of the GDPR, which the Agency ignored in the Initiation Agreement:

b) intentionality or negligence in the infringement: as noted, in this case, the requirements of intentionality in the alleged commission of the infringer or negligent behavior are not met, since a third party processed the Complainant's personal data without her consent.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/44

c) The respondent proceeded to resolve the incident subject to the complaint effectively: as indicated in the responses to the requests for information, the customer subsequently recovered the line subject to the complaint as soon as possible after Telefónica was informed of the facts, and the SIM card was refunded.

c) any measure taken by the data controller or data processor to mitigate the damages suffered by the data subjects: Telefónica took the appropriate actions, strengthening the operations established for this purpose. Furthermore, the operations prove to be completely robust based on the figures presented.

j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42: Telefónica has signed the Self-Control Code of Conduct on Data Processing in Advertising Activities, which is an out-of-court resolution system for resolving disputes that arise between citizens and entities adhering to the code due to data processing carried out in the field of advertising activities.

FOURTH. - OWN ACTS AND NON BIS IN IDEM

“TME” points out that the Agency's actions in a case involving facts substantially similar to those at issue in the complaint at hand have been contradictory, as the Agency itself informed us in the case file with reference No. EXP202104446 dated January 26, 2022, in which it was closed, considering that there was already a sanctioning procedure underway for the same facts, the verbatim of which was as follows: "In this regard, it should be noted that facts similar to those at issue in the complaint have been investigated by this Agency and sanctioned in the sanctioning procedure PS/00021/2021, processed against the respondent, by resolution dated November 8, 2021, therefore, the initiation of a new sanctioning procedure is not appropriate."

It indicates that in all sanctioning proceedings initiated against Telefónica for similar acts, such as in sanctioning proceedings EXP202209359, EXP202207989, EXP202211479, or EXP202206971, the Agency has always, and in all cases, considered the mitigating circumstance of having effectively resolved the incident that was the subject of the complaint, something that is present in this case and is ignored (e.g., Sanctioning Resolution of EXP202206971: "As mitigating circumstances: The defendant proceeded to block the line as soon as it became aware of the facts (Article 83.2 c)"

It states that the discrepancy in the administrative action between one case and another would constitute a clear violation of the doctrine of own acts. Furthermore, it points out that Telefónica has already been sanctioned for the same acts. that are currently being carried out in this procedure, and that the Agency imposed the sanction through procedure reference PS/00021/2021.

TME considers that initiating new sanctioning proceedings, successively, without a ruling from the Courts of Justice, and on the same facts, violates the principle of non bis in idem.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/44

It indicates that, according to the consolidated doctrine of the Constitutional Court, the Spanish Constitution prohibits the imposition of more than one punishment for the same offense.
This prohibition constitutes the material aspect of the non bis in idem guarantee, and the Constitutional Court has held that, although not expressly included in the constitutional text, it should be considered implicit in Article 25.1 of the Spanish Constitution due to its close connection with the principle of punitive legality, as early proclaimed by STC 2/1981, of January 30, and which all Administrative Courts have adopted: - STC 2/1981, of January 30: "Although the principle of non bis in idem is not expressly included in Articles 14 to 30 of the Constitution, which recognize the rights and freedoms eligible for protection, this does not mean that, as the parliamentarians in the Committee on Constitutional Affairs and Public Liberties of Congress understood when they omitted it in the drafting of Article 9.1 of Draft 21 of the Constitution, it is closely linked to the principles of legality and criminalization of offenses set forth mainly in Article 25 of the Constitution."

- STC 2/2003, of January 16, and 48/2007, of March 12: "The principle of non bis in idem integrates the fundamental right to the principle of legality in criminal and sanctioning matters (Article 25.1 of the Spanish Constitution) despite its lack of express mention in said constitutional provision, given its connection with the guarantees of typicality and legality of offenses."

It indicates that within the scope of applicable ordinary legislation, it is worth mentioning that, in accordance with Article 31 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector: "Acts that have been criminally or administratively sanctioned may not be sanctioned in cases where the identity of the subject, fact, and grounds is established." Therefore, it considers that this sanctioning proceeding should be closed or, at least, suspended, and await the ruling of the Courts of Justice on the matter.

For all the above, "TME" Requests:

i. A declaration that Telefónica is not liable for the alleged infringement alleged in this proceeding, ordering the closing of this sanctioning file.

ii. Alternatively, and in the event that this sanctioning file is not closed, this proceeding be suspended and the complainant be required to provide information on the status of the complaint filed, as well as the content of any ongoing criminal proceedings, in order to determine whether there is a criminal prejudicial nature.

iii. Finally, if none of the above claims are upheld, a reduction of the initially proposed sanction be made pursuant to the mitigating circumstances stipulated in Article 83 of the GDPR.

EIGHTH: On February 12, 2025, the investigating judge issued the proposed resolution and was notified electronically on February 17. same month and

year, and the proposal was made: "That the Presidency of the Spanish Data Protection Agency sanction TELEFÓNICA MÓVILES ESPAÑA, S.A.U., with NIF A78923125, for a violation of Article 6.1 of the GDPR, classified in Article 83.5 of the GDPR, with a fine of 200,000 euros (two hundred thousand euros)."

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/44

NINTH: On February 18, 2025, the TME requested an extension of the deadline to

submit its objections to the proposed resolution, and on the 24th of the same month and year, it was granted. On March 5, 2025, it submitted a written document in which it basically reproduces the same allegations made in the resolution opening the procedure. The content of said document is outlined in Legal Basis IV, "Response to the allegations submitted to the Proposed Resolution."

From the actions taken in this procedure and the documentation in the file, the following have been established:

PROVEN FACTS

First. - The complainant is a customer of TME, and is the owner of, among other services, the mobile telephone line ***TELÉFONO.1.

Second. - The record contains, provided by TME, a copy of an email sent from the address "***EMAIL.1," with the following text:

"Esim for my line ***TELÉFONO.1
My name is… (name and surname of the complainant)
With DNI… (DNI number of the complainant)
Invoice… (full invoice number)

Attached DNI.”

This email includes two files in PDF format, named “***FILE.1” and “***FILE.2,” the content of which is unknown as it was not provided to TME for investigation.

The response to this email is also provided, in which an operator agent states the following:

“If you need a new eSIM, please contact O2’s toll-free number 1551, and we will process it.

If you urgently need a duplicate, you can also request one at any Movistar store…
The O2 team.”

The document provided by TME does not specify the date of either of these emails.

Third. - On January 16, 2023, through its customer service line 1551, TME received a request for a duplicate SIM card associated with the mobile line ***TELÉFONO.1, in PDF format. E-SIM. This request was processed by

said entity.

In TME's information systems, associated with the complainant's customer file, the following entry is recorded, dated 01/16/2023 (2:10 p.m.):

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/44

"Requests a duplicate E-SIM for a line... documentation sent is confirmed... I am processing it."

TME has stated in this regard that "since the request arose from a previous email request, in which the request was forwarded to 1551, there is a record of the commercial agent in the customer file detailing that the request is being processed, since the customer sent an email with the documentation
regarding the DNI, full name, and the mobile phone number for which the request is being processed."

Fourth. - The complainant has stated that, On January 16, 2023, he lost his telephone service, so he contacted customer service by phone, who informed him about the issuance of the duplicate SIM card.

TME has also stated that its information systems contain a telephone contact from the complainant, dated January 16, 2023, at 6:41 p.m., because he had no service and that a theft lock was activated.

Fifth. - The complainant stated that, on January 17, 2023, he went to a physical TME store in ***LOCATION.1 to recover his line, where he was informed that a third party with the email address "***EMAIL.1," not associated with his contract, had requested a duplicate the previous day.

Sixth. - Regarding the shipment of the E-SIM card processed on On January 16, 2023, to which the Third Proven Fact refers, TME, in response to the request for information from this Agency's Inspection Service, stated "that the documentation was sent by email; there is no record that the E-SIM was sent to the email address listed in the claimant's customer file."

Seventh. - According to the information provided by TME, on the date of issue of the duplicate card described in the Third Proven Fact, the applicant's identification procedure included the following verifications and actions:

"- The applicant must be the cardholder.
- Must provide:

. First and last name

. Tax ID

. Last digits of the last O2 invoice number

. For sick leave due to death or disability, see procedure
- If you call from the management number, you will not receive a call.
- If you do not call from the management number, Once identified, tell them to hang up

for verification purposes, and place a call to the owner's number (see all OK).
- Whether this call is answered or not, an email is sent to the cardholder's contact email to notify them of any changes.
- The verification is completed, and the customer is called back to the number of their choice to complete the process."

Eighth. - TME has stated that, on the date the duplicate card was issued,
referenced in the Third Proven Fact, "in the specific cases of E-SIM requests, the usual identification procedures were followed as if it were a case of a duplicate SIM in physical format. They state that, for this type of request, it must be verified that the E-SIM card is sent to the email address listed in their systems on the customer's file.

Ninth. - TME has stated "that after reviewing its systems, there is no record of the request for a duplicate SIM card made by phone... On the other hand, and regarding the security call, it would not have occurred given that the documentation would have been sent by email. Notwithstanding the foregoing, the sales agent allegedly did not follow the procedure outlined for this purpose regarding the security call, which should have been made since the request came from an email address other than the one listed in the customer record.

Tenth. - TME has reported on the changes introduced after the reported events in its protocols for identifying SIM card duplicate applicants. In the document entitled "Reinforcement of Operations Protocol. Vulnerable procedures" indicates that in the case of a "call from an unknown phone number" or "contact from another email"  "the owner must be called / and/or an OTP must be sent for verification"  "The owner must approve the procedure during the call and confirm with an OTP."

LEGAL BASIS

I

Jurisdiction

In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the President of the Spanish Data Protection Agency is competent to resolve this procedure. Data Protection.

Likewise, Article 63.2 of the LOPDGDD establishes that: “The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the regulatory provisions issued in its development and, insofar as they do not contradict them, in a subsidiary manner, by the general rules on administrative procedures.”

II

Preliminary Questions

Article 4.1) of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (“the data subject”); An identifiable natural person is any person whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 15/44

an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."

Article 4.2 of the GDPR establishes "processing" as: any
operation or set of operations which is performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or

any other form of making available, alignment or combination, restriction, erasure or destruction;

In addition, Article 4.7 of the GDPR establishes that the "controller" or "controller" is: the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing; if Union or Member State law determines the purposes and means of processing, the controller or the specific criteria for its nomination may be laid down by Union or Member State law.

A SIM card is a smart card containing a chip that stores the customer's mobile telephone line number and personal identification number, but may also provide other types of data such as information on the telephone directory or call and message log. Therefore, for the purposes of Articles 4.1 and 4.2 of the GDPR, the issuance of duplicate SIM cards constitutes the processing of personal data.

TME carries out this activity as the controller, since it determines the purposes and means of processing. purposes and means of such activity, pursuant to Article 4.7 of the GDPR.

III

Response to the allegations regarding the initiation agreement

These are answered in the order set forth by TME.

PRIMARY QUESTION. - CRIMINAL PREJUDICIALITY

“TME” states that these facts are currently the subject of a criminal investigation, and therefore considers that, in application of the principle of criminal prejudiciality contained in Article 10 of the Organic Law of the Judiciary, the matter should not be resolved administratively until it is resolved criminally. This is stated, given that the facts declared proven will bind the Agency with respect to a possible sanctioning procedure, in accordance with the provisions of Article 77.4 of Law 39/2015.

It should be noted that Article 77.4 of Law 39/2015, October 1, of the Common Administrative Procedure of Public Administrations (LPACAP): "In sanctioning procedures, the facts declared proven by final criminal court rulings will bind the Public Administrations with respect to the sanctioning procedures they conduct." However, it should be noted that the triple identity necessary to apply Article 77 of the LPACAP (of subject, fact, and basis) does not exist between the administrative infraction being assessed and the potential criminal infraction(s) that could arise from the alleged Preliminary Proceedings carried out by a judicial body. This is because the infringing party is obviously not the same—with respect to violations of the LOPDGDD, the responsible party is Telefónica. while the person criminally responsible for a
potential crime of impersonation or fraud would be the third party who had

impersonated the claimant. Nor would the legal basis be the same:
while the legal right protected by the LOPDGDD is the fundamental right to the
protection of personal data, the legal right protected in the criminal offenses
whose commission would be investigated, if necessary, by the Court of First Instance would be marital status, assets, etc.

In this regard, the ruling of the National Court of
April 27, 2012 (rec. 78/2010) is very enlightening. In its second legal grounds, the Court ruled in the following terms in response to the appellant's claim that the AEPD
has violated Article 7 of Royal Decree 1398/1993 (a rule that was in force until the LPACAP came into force): "In this sense, Article 7 of Royal Decree Decree

1398/1993, of August 4, on the procedure for the exercise of sanctioning power, only provides for the suspension of the administrative procedure when the effective and real existence of a criminal proceeding is verified, if it is deemed that there is an identity of subject, fact, and legal basis between the administrative offense and the corresponding criminal offense.

However, for a criminal prejudicial ruling to arise, it is required that it directly conditions the decision to be taken or that it is essential to resolve it. These conditions do not apply in the case under consideration, in which there is a separation between the facts for which the sanction is imposed in the resolution now appealed and those that the appellant invokes as possible criminal offenses. Thus, even though, in the present case, criminal proceedings have also been initiated against the distribution company due to the facts now in dispute, the truth is that both the sanctioning conduct and the legal right protected are different in both cases (contentious-administrative and criminal). In the criminal sphere, the legal right protected is possible document falsification and fraud, and in the administrative sphere, however, it is the data subject's right to dispose of his or her personal data. Therefore, the defendant's objection must be rejected.

In light of the foregoing, the issue raised by the respondent cannot be upheld and must be rejected.

I. ON THE FACTS THAT GIVE RISE TO THE INITIATION OF THIS AGREEMENT TO INITIATE SANCTIONING PROCEEDINGS

FIRST. - NO VIOLATION HAS BEEN COMMITTED. DISAGREEMENT

WITH THE AGREEMENT TO INITIATE THE SANCTIONING PROCEEDING

“TME” expresses its complete disagreement with the initiation of this sanctioning procedure and with the provisions of the alleged proven facts set forth in the Agreement.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 17/44

grounds, indicating that, from the responses provided by the respondent party to the requests for information made by the Agency, in no case can it be inferred that they constitute an admission, presupposition, or verification by the Agency that the commercial agent did not follow the procedures related to customer identification.

The Court asserts that the technical and organizational measures implemented by "TME" are appropriate for the processing of the SIM card or E-SIM card that is the subject of the Initiation Agreement, that is, for the processing of duplicate SIM cards or E-SIM cards under the "O2" trademark, given that this is the trademark under which the mobile services subject to this proceeding are provided.

As a result, personal data has been processed, with the issuance of a duplicate SIM card to the complainant without the complainant having requested it, that is, without the complainant's intervention or knowledge.

In short, from the moment a duplicate SIM card is delivered to a person other than the line holder or authorized person, the customer loses control of the line, and the risks, damages, and losses multiply. Furthermore, the events occur with overwhelming immediacy.

The degree of liability falls within its scope, and it should be noted that the SAN (Administrative Litigation Chamber) of May 5, 2021, establishes that: "On the other hand, regarding the fact that we are dealing with fraud by a third party, as we stated in the SAN (Administrative Litigation Chamber) of October 3, 2013 (Recital 54/2012): "Precisely for this reason, it is necessary to ensure that the person contracting is who they really claim to be, and appropriate preventive measures must be adopted to verify the identity of a person whose personal data will be processed."

Therefore, TME's failure to comply with its own security policy has led to unlawful processing.

SECOND. - THE CIRCUMSTANCES THAT MADE POSSIBLE THE

OVERCOMING OF THE SECURITY POLICIES IMPLEMENTED BY THIRD PARTIES TELEFÓNICA.

FIRST. - ON THE ALLEGED INFRINGEMENT COMMITTED BY

TELEFÓNICA: LACK OF TYPICALITY, UNLAWFULNESS, AND GUILT.

In the present case, the existence of typicality, unlawfulness, and culpability in the infringing conduct of the entity responsible for processing the personal data, "TME," is evident. As the data controller for the issuance of duplicate SIM cards, which decides on the purpose, content, and use of the personal data included in the processing, it has the obligation to act with greater diligence when processing the duplicates, ensuring that it has the consent of the data subject, in order to avoid unauthorized processing of their personal data. This condition imposes a special duty of diligence when carrying out the use or processing of personal data, with regard to compliance with The duties established by data protection legislation

to guarantee the fundamental rights and public freedoms of individuals
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 18/44

physical rights, and especially their honor and personal and family privacy, the intensity of which is enhanced by the relevance of the legal assets protected by those regulations
and the professionalism of those responsible or in charge, especially when

they operate for profit in the data market; SAN 392/2015, of November 17, also ruled in this regard.

In this regard, it is significant that the operator responsible for the processing does not
duly justify the existence in its conduct of the due diligence required of it nor does it prove the adoption of the required precautions to prevent the unauthorized processing of the personal data in question (the issuance of a duplicate card) E-SIM fraudulently), which must be attributed to the negligent conduct of "TME," with a third party using the claimant's personal data and bypassing the security measures to duplicate the E-SIM card.

Regarding "TME's" liability, it should be noted that, in general, the operator processes its customers' data under the provisions of Article 6.1 b) of the GDPR, as processing is considered necessary for the execution of a contract to which the data subject is a party or for the application of pre-contractual measures at the request of the data subject. In other cases, it bases the lawfulness of the processing on the bases provided for in Article 6.1.a), c), e), and f) of the GDPR.

For this reason, this is a process in which the due diligence provided by the operator is essential to prevent this type of fraud and violation of the GDPR. This due diligence translates into the establishment of appropriate measures to ensure that the person The contracting party is who they claim to be, and appropriate measures are implemented and maintained to comply with the principle of lawfulness.

The Constitutional Court stated in its Ruling 94/1998, of May 4, that we are faced with a fundamental right to data protection, which guarantees individuals control over their data, any personal data, and over its use and destination, to prevent illicit trafficking or data that is harmful to the dignity and rights of those affected. Thus, the right to data protection is defined as a right of citizens to object to certain personal data being used for purposes other than those that justified their acquisition.

For its part, Ruling 292/2000, of November 30, considers it an autonomous and independent right consisting of a power of disposition and control over personal data, which empowers individuals to decide which of these data to provide to a third party, whether the State or an individual, or which third party may collect, and which also allows the individual to know who possesses that personal data and for what purpose, and to be able to object to that possession or use.

Regarding the conduct of "TME," it is considered to fall under the heading of culpability. As a large-scale custodian of personal data, and therefore accustomed to or specifically dedicated to managing clients' personal data, it must be especially diligent and careful in its processing. In other words, from the perspective of culpability, we are faced with an avengeable error since, with the application of appropriate technical and organizational measures, these identity thefts could have been avoided.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 19/44

Recital 74 of the GDPR states: The liability of the data controller for any processing of personal data must be established. personal data

carried out by itself or on its own behalf. In particular, the controller must
be obliged to implement timely and effective measures and must be able to demonstrate the
compliance of the processing activities with this Regulation, including the
effectiveness of the measures. Such measures must take into account the nature,
scope, context, and purposes of the processing, as well as the risk to the rights and
freedoms of natural persons. Furthermore, Recital 79 states: The protection

of the rights and freedoms of data subjects, as well as the responsibility of controllers and processors, including with regard to
supervision by supervisory authorities and the measures taken by them, require a clear attribution of responsibilities under this
Regulation, including in cases where a controller determines the purposes and

means of processing jointly with other controllers, or where the processing is carried out on behalf of a controller.

On the other hand, and strictly with regard to negligence In the case of "TME", it should be noted that SAN - Administrative Litigation Chamber - 392/2015, of November 17, in its Third Legal Basis, reflects the Constitutional Court's doctrine on the application of the principles of criminal law to administrative sanctioning law, in the following terms:

The Constitutional Court has repeatedly declared that the principles of criminal law, including the principle of culpability, are applicable, with certain nuances, to administrative sanctioning law, as both are manifestations of the State's punitive system (STC 18/1987, 150/1991), and that strict liability or liability without fault is not applicable within the scope of administrative sanctions, by virtue of which the possibility of imposing sanctions based solely on the result is excluded, without proving even a minimum of culpability, even on the grounds of mere negligence (SSTC 76/1990). and

164/2005).

The principle of culpability, guaranteed by Article 25 of the Constitution, limits the State's exercise of the "ius puniendi" and requires, as stated by the Constitutional Court in Judgment 129/2003 of June 20, that the imposition of the sanction be based on the subjective element of culpability, in order to guarantee the principle of liability and the right to a sanctioning procedure with all the necessary guarantees (Supreme Court Judgment of March 1, 2012, Rec. 1298/2009).

Certainly, the principle of culpability, provided for in Article 28 of Law 40/2015 of October 1, on the Legal Regime of the Public Sector, stipulates that only those responsible for such acts constituting an administrative offense may be sanctioned. Obviously, this means that so-called "strict liability" is banished from the scope of administrative sanctioning law, and the term "culpable" includes inexcusable imprudence, negligence, or ignorance. The majority of our Supreme Court's case law (starting with its rulings

of January 24 and 25 and May 9, 1983) and the doctrine of the Constitutional Court
(after its STC 76/1990) emphasize that the principle of culpability, although not explicitly recognized in the Constitution, is inferred from the principles of legality and
the prohibition of excess (Article 25.1 of the Spanish Constitution), or from the inherent requirements of a

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 20/44

rule of law, which requires the existence of intent or negligence (in this regard, STS of January 21, 2011, Rec 598/2008).

However, the method of attributing liability to legal entities does not correspond to the forms of intentional or reckless culpability that are attributable to human conduct. Thus, in the case of violations committed by legal entities, although the element of culpability must be present, it is necessarily applied differently than it is with respect to natural persons. According to STC 246/1991, "(...) this different construction of the imputability of the authorship of the infringement to the legal entity arises from the very nature of the legal fiction to which these subjects respond. They lack the volitional element in the strict sense, but not the capacity to violate the rules to which they are subject.
The capacity to violate and, therefore, direct blameworthiness derives from the legal asset protected by the rule being violated and the need for such protection to be truly effective and from the risk that, consequently, must be assumed by the legal entity that is subject to compliance with said rule" (in this regard, STS of November 24, 2011, Rec 258/2009).

To the above, it should be added, following the judgment of January 23, 1998, partially transcribed in the Supreme Court rulings of October 9, 2009, Rec 5285/2005, and of October 23, 2010, Rec 1067/2006, that "although the culpability of the conduct must also be subject to proof, it must be considered, in order to assume the corresponding burden, that the volitional and cognitive elements necessary to assess such conduct ordinarily form part of the proven typical conduct, and that their exclusion requires proof of the absence of such elements, or, in its normative aspect, that the due diligence required by the person claiming their absence has been exercised; in short, invoking the absence of culpability is not sufficient to exonerate a person from typically unlawful conduct."

Thus, in the case at hand, after analyzing the specific circumstances of the case, it has been determined that TME failed to comply with its own security measures and instructions regarding the duplicate SIM card, which led to illicit processing.

SECOND. – ABSENCE OF GUILT. TYPE OF ERROR.

TME states that the requirement of culpability in its actions is not met and points out that the handling of the duplicate E-SIM card was, in any case, the result of acts of deception, manipulation, and illicit use of data by a third party, who deceived the sales agent into believing that they were the data owner or that they had their consent to submit the request, having correctly identified themselves with the customer data contained in our systems.

Therefore, it indicates that Telefónica could never be considered guilty, as in this case an invincible error exists.

Indeed, the principle of culpability governs administrative sanctioning law (Article 28 of Law 40/2015, on the Legal Regime of the Public Sector, LRJSP), so the subjective or culpable element is an essential condition for the emergence of sanctioning liability. Article 28 of the LRJSP, "Liability," states:

"1. Only natural and legal persons, as well as, when a law recognizes their legal capacity, affected groups, unions and entities without legal personality, and independent or autonomous assets, who are found liable for such acts due to intent or negligence, may be sanctioned for acts constituting an administrative infraction."

In light of this provision, sanctioning liability may be imposed based on intent or negligence, with mere failure to comply with the duty of care being sufficient in the latter case.

The Constitutional Court, among others, in its STC 76/1999, has declared that administrative sanctions share the same nature as criminal sanctions, being one of the manifestations of the State's ius puniendi, and that, as a requirement derived from the principles of legal certainty and criminal legality enshrined in Articles 9.3 and 25.1 of the Spanish Constitution, their existence is essential for their imposition. Regarding the culpability of legal entities, it is appropriate to cite STC 246/1991, December 19, 1991 (F.J. 2), according to which, with respect to legal entities, the subjective element of culpability must necessarily be applied differently than with respect to natural persons. It adds that "This different construction of the imputability of the authorship of the violation to the legal entity arises from the very nature of the legal fiction to which these entities respond. They lack the volitional element in the strict sense, but not the capacity to violate the rules to which they are subject. The capacity to violate and, therefore, direct blameworthiness that derives from the legal right protected by the rule being violated and the need for such protection to be truly effective [...]."

At this point, it is worth recalling what STC 246/1991 stated regarding the culpability of legal entities: that they do not lack the "capacity to infringe the rules to which they are subject." "The capacity to infringe [...] derives from the legal interest protected by the rule being infringed and the need for such protection to be truly effective [...]."

In connection with the above, reference should be made to Article 5.2 of the GDPR (principle of proactive accountability), according to which the data controller shall be responsible for compliance with the provisions of paragraph 1—for the purposes of this article, the principle of lawfulness in relation to Article 6.1 of the GDPR—and be able to demonstrate compliance. The principle of proactivity transfers to the data controller the obligation not only to comply with the regulations, but also to be able to demonstrate such compliance.

Opinion 3/2010 of the Article 29 Working Party (WP29) - WP 173 - issued during the repealed Directive 95/46/EEC's validity, but whose reflections are still applicable today, states that the "essence" of proactive accountability is the controller's obligation to implement measures that, under normal circumstances, ensure compliance with data protection rules in the context of processing operations and to have available documents demonstrating to data subjects and supervisory authorities what measures have been taken to achieve compliance with data protection rules. Article 5.2 expands on Article 24 of the GDPR, which requires the controller to adopt appropriate technical and organizational measures "to ensure and be able to demonstrate" that the processing complies with the GDPR. The provision establishes:

"Responsibility of the controller"

"1. Taking into account the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organizational measures to ensure and be able to demonstrate that the processing complies with this Regulation. These measures shall be reviewed and updated as necessary.
2. Where proportionate to the processing activities, the measures referred to in paragraph 1 shall include the implementation by the controller of appropriate data protection policies.
3. Adherence to codes of conduct approved pursuant to Article 40 or to a certification mechanism approved pursuant to Article 42 may be used

as elements to demonstrate compliance with the controller's obligations.

Article 25 of the GDPR, “Data Protection by Design and by Default,” states:

“1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity that processing entails for the rights and freedoms of natural persons, the controller shall, both when determining the means of processing and at the time of processing, implement appropriate technical and organizational measures, such as pseudonymization, designed to effectively implement data protection principles, such as data minimization, and to integrate appropriate safeguards into the processing, in order to meet the requirements of this Regulation and protect the rights of data subjects. 2.[...]".

The Supreme Court ruling of October 17, 2007 (rec. 63/2006) is fully applicable to the case. After referring to the fact that entities whose activities involve continuous processing of client and third-party data must observe an adequate level of diligence, it states: "[...] the Supreme Court has understood that negligence exists whenever a legal duty of care is disregarded, that is, when the offender fails to behave with the required diligence. And in assessing the degree of diligence, the professionalism of the individual must be especially considered. There is no doubt that, in the case under consideration, when the appellant's activity involves constant and extensive handling of personal data, rigor and exquisite care must be emphasized to comply with the legal provisions in this regard.

On the other hand, regarding the illicit use of data by a third party, in order to complete the scam, a third party must "impersonate" the data holder.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 23/44

to receive the duplicate E-SIM card. This entails, a priori, a
processing that violates the principle of lawfulness, since a third party is processing data, since
they have access to it without any legal basis, in addition to violating other

principles such as confidentiality.

For this reason, this is a process in which the due diligence provided by the operators is essential to prevent this type of scam and violation of the GDPR.
Diligence that translates into the establishment of adequate measures to ensure that appropriate security measures are implemented and maintained to effectively protect the confidentiality, integrity, and availability of all personal data for which they are responsible, or that they have been entrusted to another controller.

THIRD. – ON THE CRITERIA FOR GRADUATING THE PENALTY

Regarding the breach of the principle of proportionality, the GDPR expressly provides for the possibility of grading, by establishing fines that can be adjusted, based on a series of circumstances in each individual case.

These circumstances have been taken into account when setting the penalty.

In this sanctioning procedure, the sanction is imposed because "TME" provided a duplicate of the complainant's E-SIM card to a third party without the complainant's consent and without verifying the third party's identity. For this reason, Article 6.1 of the GDPR is being invoked.

"TME" requests that the following mitigating circumstances be considered:

b) intentionality or negligence in the infringement: as noted, the requirements of intentionality in the alleged infringer's commission or negligent conduct are not met in this case, since it was a third party who processed the Complainant's personal data without her consent.

c) The respondent proceeded to resolve the incident that was the subject of the complaint effectively: as indicated in the responses to the requests for information, the customer subsequently recovered the line that was the subject of the complaint as soon as possible after Telefónica was informed of the facts, and the amount for the SIM card was refunded.

c) Any measures taken by the data controller or processor to mitigate the damages suffered by the data subjects: Telefónica took the appropriate actions, strengthening the operations established for this purpose. Furthermore, the operations prove to be completely robust based on the figures presented.

j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42: Telefónica has signed the Self-Control Code of Conduct on Data Processing in Advertising Activities, which is an out-of-court resolution system for resolving disputes that arise between citizens and entities adhering to the code regarding data processing carried out in the context of advertising activities.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 24/44

None of the circumstances invoked are admitted.

Regarding the alleged lack of intentionality or negligence, we refer to the considerations made regarding the presence of the element of culpability, specifically a serious lack of diligence.

The respondent acted with serious lack of due diligence in the processing carried out in the course of its business activities.

Regarding the degree of due diligence required to comply with data protection regulations, it is worth mentioning the SAN (National Sanitary Order) of 10/17/2007 (Recital 63/2006), which, despite having been issued under the previous regulations, is fully applicable. It states that "[...] the Supreme Court has considered that negligence exists whenever a legal duty of care is disregarded, that is, when the offender fails to behave with the required diligence. And in assessing the degree of diligence, the professionalism or lack thereof of the subject must be especially considered, [...].

The respondent states that it effectively resolved the incident that is the subject of the complaint, but it should be noted that it falls within the scope of its legal obligations—for the purposes of the principle of legality—the respondent must act with the diligence required by the circumstances of the case and is obliged to adopt the technical and organizational measures that allow it to comply with and be able to prove compliance with the principles of data protection.

Thus, as has been noted, any violation of data protection regulations must be accompanied by intent or negligence. This applies to both a personal data controller and the data subject. natural person, as a legal entity, whether a small company with little connection to the processing of personal data, or a large company, a multinational, etc., and with continuous and large-scale processing of personal data, for example.

Therefore, once it has been determined that, as a premise, this underlying subjective element of culpability exists, this does not prevent this circumstance from being considered an aggravating factor, given that, in accordance with the specific circumstances of the case, a different degree of intentionality or negligence in the actions of the offender is considered. However, in no case can this circumstance be considered a mitigating factor in the sense argued by Telefónica.

Regarding the fact that "TME" took the appropriate actions, strengthening the operations established for this purpose.

Well, it is important to highlight that the duplicate E-SIM was issued and activated despite having been requested from a different email address than the one registered for the complaining party in the brand's systems. O2 of TME, and it has been shown that the verification call was only mentioned in the security policy in the event that the applicant called from another number, and it did not explicitly specify how to proceed in the event of receiving emails from another address. Therefore, the established mechanism was not sufficient to verify the veracity of the identity data provided.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 25/44

Furthermore, the principle of proactivity implies transferring to the data controller the obligation not only to comply with the regulations, but also to be able to demonstrate compliance. Among the mechanisms that the GDPR contemplates to achieve this are those provided for in Article 25, "data protection by design," according to which the data controller must apply "both at the time of determining the means of processing and at the time of the processing itself" technical and Organizational measures to ensure that it effectively applies the principles of the GDPR in the processing it carries out.

TME argues that its adherence to conflict resolution mechanisms should be considered a mitigating factor.

The Code of Conduct for Data Processing in Advertising Activities. The main objective of this Code is to allow users who wish to do so when they believe their data protection rights have been violated in the context of an advertising activity, such as: receiving unwanted advertising, exercising advertising-related rights (such as the right to object), and the processing of data in advertising promotions or through advertising cookies, among others, which is not the case here and therefore cannot be considered a mitigating factor.

FOURTH. - OWN ACTS AND NON BIS IN IDEM

Telefónica cites in its defense a series of resolutions issued by the AEPD,
stating that EXP20210446 was closed on the understanding that

there was already a sanctioning procedure underway for the same events and that Telefónica
has already been sanctioned for the same events currently being discussed in this procedure.
The Agency imposed the sanction through procedure reference
PS/00021/2021 and therefore violates the non bis principle.

In this regard, although the facts stated in the complaint are not the same, it should be noted that the purpose of these procedures was to analyze the procedures followed to manage SIM replacement requests by Telefónica, identifying any vulnerabilities that may exist in the operational procedures implemented, to detect the causes of these cases, as well as to identify areas of non-compliance, improvements, or adjustments, in order to determine responsibilities, reduce risks, and increase the security of the processing of the personal data of the affected individuals. The sanctioning procedure PS/00021/2021, filed against the respondent, was sanctioned for violating Article 5.1f), not for processing data without legal grounds, but rather to guarantee the principle of confidentiality. On February 8, 2024, a SAN judgment was issued on February 8, 2024 (rec. 2250/2021), in which the administrative appeal filed by "TME" was dismissed. On June 19, 2024, the First Section of the Administrative Litigation Division of the Supreme Court ruled that the appeal for cassation No. 3244/2024 filed by Telefónica Móviles España SAU was inadmissible for processing. Administrative Litigation Chamber of the National High Court in the contentious appeal
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 26/44

-administrative appeal no. 2250/2021 filed against the resolution of November 8, 2021, of the Director of the Spanish Data Protection Agency, issued in the sanctioning procedure PS/00021/2021, imposing a penalty of (...),

for a violation of Article 5.1.f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, classified as very serious in Article 83.5.a) of the aforementioned Regulation.”

IV

Response to the allegations presented to the Proposed Resolution

Next, we respond to the allegations presented by TME, which are, in general terms, a reiteration of those presented to the initiation agreement and answered in the proposed resolution, as reproduced in the previous Legal Basis.

PRIMARY QUESTION I. - ON THE INITIATION OF THE SANCTIONING PROCEEDINGS.

Regarding the first allegation, which indicates that TME uses all necessary means to prevent and avoid fraud among its clients, adopting appropriate and specific measures to protect the interests and fundamental rights of the data subject based on the purpose of the processing, but cannot guarantee, and the Agency cannot require it to do so under penalty of a fine, its eradication.

In this regard, assessing whether the previously adopted measures were adequate or not is irrelevant, since these measures have not been followed by the respondent itself.

The adoption of technical and organizational measures presupposes compliance with them; otherwise, it makes no sense to invoke their establishment.

In this regard, it should also be noted that the SAN of October 29, 2024, rec. 1824/2021 provides that:

“…it should be emphasized, in relation to technical and organizational measures, that this is not

a merely formal requirement, but a material one. In this sense, and in line
with the above, as stated in the Supreme Court of February 15, 2022 (Recital 7359/2020), “It is not enough to design the necessary technical and organizational means;
it is also necessary to implement them correctly and use them appropriately, so that the court will also be liable for a lack of due diligence in their use, understood

as reasonable diligence considering the circumstances of the case,” which does not
imply require an obligation to achieve results.”

Likewise, it is worth mentioning Constitutional Court ruling 94/1998, dated May 4, in which the Constitutional Court stated that we are faced with a fundamental right to data protection, which guarantees individuals control over their data, any personal data, and its use and destination, to prevent illicit trafficking of such data or data that is harmful to the dignity and rights of those affected.
Thus, the right to data protection is defined as a right of citizens to object to the use of certain personal data for purposes other than those that justified its collection.

In this case, the sanction is not the existence or absence of technical and organizational measures, but rather the fact that, in this specific case, the processing of the complainant's personal data was carried out without complying with the lawfulness requirements established in Article 6.1 of the GDPR. The violation of this article confirms that the respondent engaged in unauthorized processing of the data, thereby violating the complainant's rights. The degree of liability falls within its scope. It should be noted that the SAN (Administrative Litigation Chamber) of May 5, 2021, establishes that: "On the other hand, regarding the fact that we are dealing with fraud by a third party, as we stated in the SAN of October 3, 2013 (Recital 54/2012): "Precisely for this reason, it is necessary to ensure that the person contracting is who they claim to be, and appropriate preventive measures must be adopted to verify the identity of a person whose personal data will be processed."

Therefore, the determining factor in concluding the existence of an infringement in this case is the fact that TME processed the personal data without the knowledge or consent of the complaining party, not whether said entity has the necessary means to prevent and avoid fraud, nor whether this security policy was respected.

The need to establish protocols that ensure compliance with the principles of processing, such as lawfulness, is linked to the obligation that the GDPR imposes on data controllers to demonstrate compliance with the law. In this case, TME has not been able to demonstrate that the processing of personal data for which it is sanctioned was carried out in compliance with the principle of lawfulness regulated in Article 6 of the GDPR.

Moreover, the steps taken by TME to ultimately issue the duplicate SIM card to the complainant offered sufficient evidence to show that said duplicate SIM card might not have been requested by its true owner, highlighting the negligent conduct of the responsible operator. Nothing could be simpler than paying attention to the fact that the request for a duplicate card was made, in the first attempt, from an email address other than the one listed in the customer's file and, subsequently, via the telephone service from a line that also did not correspond to the party. Claimant.

PRIMARY QUESTION II.- CRIMINAL PREJUDICIALITY

Regarding the question of criminal prejudiciality, TME indicates that it requested that the proceedings be suspended in order to determine the status of the complaint filed by the affected party and, above all, to understand the content of any ongoing criminal proceedings.

Telefónica cites Judgment No. 2249/2016 of the Administrative Litigation Division of the Supreme Court dated October 18, 2016, in which, despite the fact that the administrative procedure and the criminal procedure concerned different taxes, the exception of criminal prejudiciality was granted.

Therefore, TME believes that the suspension should proceed. of this sanctioning procedure until the criminal courts rule on the matter.

In the judgment cited by TME, there is a triple identity of subject, fact, and grounds, which is not the case here, and we reiterate what we stated in the response to the allegations regarding the initiation agreement.

In this regard, the previous Legal Basis serves as a response to the allegations at the opening of the case, which noted that in this case the triple identity required to order the suspension of the administrative procedure due to its connection with the actions taken in the criminal jurisdiction is not met:

- The offending party is obviously not the same – with respect to violations of the GDPR, the responsible party is Telefónica, while the criminally responsible party for a potential crime of impersonation or fraud would be the third party who had impersonated the claimant.

- Nor would the legal basis be the same: while the legal right protected by the LOPDGDD is the fundamental right to the protection of personal data, the legal right protected in the criminal offenses whose commission would be investigated, if necessary, by the Court of First Instance would be marital status, assets, etc.

In this regard, the ruling of the National Court of April 27, 2012 (rec. 78/2010), already cited in the aforementioned Legal Basis III, is very enlightening.

In view of the foregoing, the issue raised by the respondent cannot be upheld and must be rejected.

REGARDING THE FACTS THAT GIVE RISE TO THE INITIATION OF THIS AGREEMENT

TO INITIATE THE SANCTIONING PROCEDURE.

FIRST AND SECOND. - NO INFRINGEMENT COMMISSIONED.
DISAGREEMENT WITH THE AGREEMENT TO INITIATE THE SANCTIONING PROCEEDINGS. BREACH OF THE PRINCIPLE OF THE PRESUMPTION OF INNOCENCE, TELEFÓNICA'S ROLE AS A VIOLATED PARTY

After questioning some of the facts and conclusions assessed in the proposed resolution, such as the failure to comply with its own security protocols, the failure to verify the identity of the applicant for the duplicate SIM card, which was issued based on a request made from an email address that did not belong to the cardholder and without making any verification calls, the Court warns that the failure to make this call or the lack of a recording does not imply that the salesperson did not follow the established protocol regarding customer identification.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 29/44

The Spanish Supreme Court (TME) points out that one of the basic principles governing punitive administrative law, which has acquired the status of a fundamental right through Article 24.2 of the Spanish Constitution, is the presumption of innocence. This presumption, in this case, has been called into question by the case opened by the Agency without considering the principles governing the sanctioning system. All this because, in order for a fine to be imposed in this case, it must be based on validly presented evidence that establishes Telefónica's guilt.

The Agency points out that the Agency has not been able and cannot prove that Telefónica has not been diligent in this case. Telefónica is the victim of deception by the fraudsters, who had all the necessary data in advance to carry out this request. On the contrary, Telefónica has demonstrated compliance with the obligations arising from the principles of proactive responsibility and due diligence when reviewing and updating the measures implemented so that they are adequate to the new risks being detected. It also points out the procedures for duplicating SIM or e-SIM cards and once again provides the relevant documentation to clarify what happened, describing the events that occurred and indicating the new measures it is adopting. To this end, TME refers, in its defense, to the set of security measures it has adopted, which are the minimum required of any organization with the characteristics and context in which a telecommunications operator operates.

In this sense, the mere existence of a security policy cannot justify compliance with the principle of lawfulness provided for in Article 6.1 of the GDPR. In addition to existing measures, these measures must be effective, allowing the data controller to prove that the data processing carried out is lawful. Otherwise, the measures adopted are ineffective.

Well, in this case, TME, in its response dated September 4 of the same year, the defendant acknowledged that the fraudulent duplicate had occurred, stating: "After reviewing its systems, there is no record of the request for a SIM card duplicate made over the phone. However, as the request came from a previous email request that led to the request to 1551, there is a record of the sales agent in the customer's file detailing that the request was being processed, since the customer sent an email with the documentation regarding the customer's ID, full name, and the mobile phone number for which the request was requested. A copy of this documentation is attached as Annex 1. On the other hand, and with respect to the security call, it would not have occurred since the documentation would have been sent via email. Notwithstanding the foregoing, the sales agent would not have followed the procedure outlined for this purpose with respect to the security call, which should have been made since the request came from an email address other than the one listed on the customer record."

(…)
“At the time of the events, in the specific cases of E-SIM requests, the usual identification procedures were followed as if it were a case of a duplicate SIM card in physical format. They state that, for these types of requests,

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 30/44

it must be verified that the E-SIM card is sent to the email address listed in their systems on the customer's record.

Regarding the specific case of this claim, they indicate that, as reflected in the documentation attached as Annex 1, it can be seen that the documentation was sent by email, there is no record that the E-SIM was sent to the email address listed on the claimant's customer record.”

TME acknowledges that the procedure it implemented itself was not followed, since,

if it had been, the duplicate E-SIM card would have been denied.

Ultimately, the defendant cannot exonerate its liability by simply appealing
to the existence of minimum measures and the deception to which companies and their salespeople are subjected by the impersonators.

Furthermore, it is incomprehensible that TME would question facts that have been
sufficiently proven, even acknowledged by the entity itself. These facts are sufficiently valid to overturn the presumption of innocence.

The actions have established both the unlawful data processing and TME's responsibility in carrying it out.
Nor is it understood that the Spanish Ministry of Economy and Finance (TME) intends this AEPD to classify as diligent an action in which a request for a duplicate SIM card is processed without certainty about the origin of the request and with clear evidence that the origin was not related to the cardholder.
It is worth reiterating what was stated in the SAN of October 29, 2024, rec. 1824/2021, cited above, which states that "...it must be emphasized, in relation to technical and organizational measures, that this is not merely a formal requirement, but a material one. In this sense, and in line with the above, as stated in the Supreme Court Judgment of February 15, 2022 (Recital 7359/2020), "It is not enough to design the necessary technical and organizational means; their correct implementation and appropriate use are also necessary, so that the court will also be liable for a lack of diligence in their use, understood as reasonable diligence considering the circumstances of the case," which does not imply that an obligation to achieve results is required."

II. ON THE LEGAL BASIS

FIRST. - REGARDING THE ALLEGED INFRINGEMENT COMMITTED BY TELEFÓNICA: LACK OF TYPICALITY AND UNLAWFULNESS.

TME considers that the principle of typicality is being violated given that the conduct carried out by Telefónica is not subsumed under the typical action imputed to it, which is an alleged unlawful processing of customer data due to the lack of a legitimate basis for doing so. TME confirms that the legal basis legitimizing the processing of the complainant's personal data is none other than the performance of the contract, that is, the legitimate basis contemplated in section b) of the aforementioned article 6.1: "the processing is necessary for the performance of a contract to which the data subject is a party or for the application, at the request of the data subject, of pre-contractual measures." C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 31/44

That is, in this specific case, the processing of personal data is carried out for the purpose of managing a replacement of a duplicate E-SIM card, in order to correctly execute the contract that the Complainant has signed with Telefónica.

Therefore, in any case, if an infringement had been committed, it would have been committed by the impersonator and not Telefónica, since the latter would have processed the customer's data without any legitimate basis to do so.

TME points out that, taking into account both Telefónica's allegations and the Agency's own arguments, the processing carried out by this party is lawful and the disciplinary proceedings should therefore be closed as it is not the typical action.

It also states that Telefónica's conduct is not subsumed under the provision for which the violation is alleged and cannot be considered unlawful.

Telefónica considers that it has acted at all times in good faith and with a well-founded belief that excludes any culpability, as we recall once again that the request received included both the identification data of the line holder and the identity document itself.

But, in any case, even if the Agency considers that there has been unlawful data processing on this part, considering that Telefónica's action is typical and unlawful, in no case can it be asserted that the conduct

followed by Telefónica can be considered culpable.

According to TME, in this case, where, according to the operation, the customer would have identified himself with the correct data for the duplicate request, it is established that we would be facing an insurmountable error, where the unlawfulness of the conduct was unknown, and the procedure should be closed, as Telefónica's culpability cannot be determined.

On these issues, we can only refer to the arguments in the previous legal grounds, in response to the allegations at the opening of the procedure, similar to those set forth above.

Furthermore, it should be noted that in no way can the error it claims to have committed be considered to exclude its liability, since, according to established case law, the existence of such an error cannot be deemed to be attributable to the party responsible for it or when it could have been avoided with greater diligence.

SECOND. – PROPORTIONALITY OF THE SANCTION

TME indicates that if it does not agree to close this sanctioning procedure, it wishes to express its disagreement with the proposed sanction, considering it to be contrary to the principle of proportionality and also because a series of aggravating factors that would not apply to this specific case have been taken into consideration, as well as the mitigating factors already stated by this party, without these having been taken into account by the Agency.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 32/44

1. Regarding the aggravating factors taken into account that are not applicable to the specific case:

a) "The evident link between the business activity of the defendant and the processing of personal data of clients or third parties (Article 83.2.k of the GDPR in relation to Article 76.2.b of the LOPDGDD)."

Regarding this aggravating factor raised, TME points out that there would have to be a large number of data subjects affected by the potential infringement. In other words, the GDPR does not establish that this aggravating factor should be assessed de facto when a data controller generally processes a large or "massive" amount of personal data, but rather based on the number of potential data subjects. And this position we maintain is corroborated by the European Data Protection Board, which endorsed and therefore adopted the content of the Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679 adopted by the Article 29 Working Party on October 3, 2017. These clearly state that the factors provided for in Article 83.2 of the GDPR must be assessed in combination, that is, in what concerns us now, the number of data subjects together with the potential impact on them.

Similarly, Recital 75 of the GDPR provides that, in order to determine the degree of damage that a potential data protection breach may cause, one must take into account, among other aspects, "that the processing involves a large amount of personal data and affects a large number of data subjects."

This means, contrary to the Agency's recurring interpretation, that the aggravating circumstance should only be applied if the violation affects many interested parties.

b) The circumstance outlined in Article 83.2.e) of the GDPR, relating to any violation committed by the data controller or processor.

In this regard, it should be noted that:

- The sanctioning resolution EXP202211479 would not have become final in the administrative proceedings until July 19, 2023, once the possibility of filing administrative appeals had been exhausted. 22

- The sanctioning resolution EXP202207989 did not even become final on December 20, 2023, once the possibility of filing administrative appeals had been exhausted. Considering this fact, the typical action prosecuted in this sanctioning case stems from an action that occurred between January 13 and 17, 2023, that is, prior to the aforementioned sanctioning resolutions.

It is clear, therefore, that when the E-SIM card was replaced, that is, on January 16, 2023, no sanctioning resolution had been issued, much less a "final" one in the administrative proceedings, for acts of the same or similar nature.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 33/44

Therefore, the requirement for a sanction prior to the facts required for the application of the aggravating circumstance of recidivism was not met, as established by the jurisprudence of the Supreme Court, which has repeatedly stated (for all of them, we cite the judgments of October 24, 2000, March 11, 2003, March 23, 2005, and September 30, 2009) that the aggravating circumstance of administrative recidivism must refer to acts that had already been sanctioned in another procedure resolved prior to the commission of the new offense.

Furthermore, in any case, and as the Agency is well aware, both sanctioning procedures have been appealed by this party before the National Court because it considers that the resolutions leading to the imposition of the sanction are null and void, as the principle of criminality is not met in either of them.

Consequently, this aggravating circumstance should not be taken into account either, and the amount of the sanction or sanctions ultimately imposed should be reduced.

2. Regarding the mitigating circumstances that have not been taken into account by the Agency in the proposed resolution, if the Agency considers that the action is criminal, unlawful, and culpable, and therefore, TME should be sanctioned, it is important to emphasize, as a subsidiary matter, that the following mitigating circumstances of Article 10 should be taken into account. 83.2 of the GDPR:

b) intentionality or negligence in the infringement: as noted, in this case, the requirements of intentionality in the alleged commission of the infringer or negligent conduct are not met, since a third party processed the Complainant's personal data without their consent after obtaining it illegally.

c) any measures taken by the data controller or processor to mitigate the damages suffered by the data subjects: Telefónica took the appropriate actions, strengthening the operations established for this purpose.

j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42: Telefónica has signed the Self-Control Code of Conduct on Data Processing in Advertising Activities, which is an out-of-court resolution system for resolving disputes that arise between citizens and entities adhering to the code regarding data processing carried out in the context of advertising activities.

For all the above reasons, if the Agency decides to uphold the fine, according to TME, these mitigating factors should be taken into account to reduce the fine.

TME questions whether the link between its activity and the processing of personal data can be taken into account when determining the fine, noting that this scaling factor is related to the number of data subjects affected by the violation and the degree of damages it may have caused. However, nothing in the letter of the law allows for this conclusion. The applicable regulation is clear when it establishes that when deciding whether to impose a fine and its amount, "the connection between the offender's activity and the processing of personal data" will be taken into account, as this AEPD has been doing when the offender carries out an activity that involves a high volume of data processing and the violation is related to their main activity.

This was also the opinion of the National Court in its ruling of September 13, 2024, when it stated the following:

"In the case at hand, the appellant achieved a turnover exceeding €46 million in 2018 and had more than 600 employees. The sanction imposed cannot be considered disproportionate given the circumstances, taking into account its turnover and its connection to the processing of personal data, taking into account the number of employees at UST and its activity."

Regarding the previous violations committed by TME, also considered when determining the fine to be imposed, the entity understands that the precedents identified by this AEPD had not become final at the time the acts subject to the procedure were committed. However, this is not the criterion determining the application of this grading factor. Any violation committed by the responsible entity that was verified before the resolution assessing these previous violations was issued is used for this purpose.

This is also the understanding of the EDPB, which in its Guidelines 4/2022 on the calculation of fines under the GDPR states:

“5.4 — Previous infringements by the controller or processor

82. Previous infringements are infringements already established before the adoption of the decision. In the case of cooperation under Chapter VII of the GDPR, previous infringements are those already established before the draft decision is issued (within the meaning of Article 60 of the GDPR).”

As for the mitigating circumstances invoked by TME, it should be reiterated that they have already been rejected in the previous legal basis, to which reference should be made again. III
Breached Obligation

The defendant is charged with committing an infringement for violating Article 6 of the GDPR, "Lawfulness of Processing," which sets forth in Section 1 the circumstances in which the processing of third-party data is considered lawful:
"1. Processing shall only be lawful if at least one of the following conditions is met:

a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
b) processing is necessary for the performance of a contract to which the data subject is a party or for the implementation, at the request of the data subject, of pre-contractual measures;
c) processing is necessary for compliance with a legal obligation applicable to the data controller;
d) processing is necessary to protect the vital interests of the data subject or of another natural person;

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 35/44

e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. The provisions of point (f) of the first paragraph shall not apply to processing carried out by public authorities in the exercise of their tasks.

It is important to note that Article 4.1 of the GDPR defines "personal data" as
"any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is any person whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."

It should be noted that data processing requires a legal basis.

Pursuant to Article 6.1 of the GDPR, in addition to consent, there are other possible grounds that legitimize data processing without the need for the data subject's authorization, in particular, when it is necessary for the performance of a contract to which the data subject is a party or for the implementation, at the data subject's request, of pre-contractual measures, or when it is necessary for the protection of legitimate interests pursued by the data controller or a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject that require protection of such data. Processing is also considered lawful when it is necessary for compliance with a legal obligation to which the data controller is subject, to protect the vital interests of the data subject or another natural person, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In the present case, the respondent is accused of violating Article 6.1 of the GDPR, as the unlawfulness of the processing carried out has been evident, and none of the grounds for legitimation provided for in the aforementioned article have been proven in relation to the processing of the complainant's data.

Processing is considered to be any operation carried out on personal data,
including the communication of such data to a third party. Article 4, point 2 of the GDPR defines processing as "any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization,
structuring, storage, adaptation or modification, extraction, consultation,
use, disclosure by transmission, dissemination or any other form of

making available, alignment or combination, restriction, erasure or destruction."

It is proven in the proceedings that "TME" processed the complainant's personal data to issue a duplicate SIM card for a telephone line

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 36/44

owned mobile phone, in E-SIM format (virtual SIM), which it subsequently provided to a third party without the complainant's consent and without any other legal basis to support such processing of personal data.

Furthermore, the issuance of a duplicate E-SIM card entails the processing of the personal data of its owner, since any person whose identity can be determined, directly or indirectly, in particular, through an identifier (Article 4.1 of the GDPR) is considered an identifiable natural person.

Therefore, the E-SIM card identifies a telephone number, and this number, in turn, identifies its owner. In this regard, the CJEU judgment in Case C-101/2001 (Lindqvist) of 6 November 2003, paragraph 24, ECR 2003 p. I-12971: "The concept of 'personal data' used in Article 3(1) of Directive 95/46 includes, according to the definition in Article 2(a) of that directive, 'any information relating to an identified or identifiable natural person'. This concept undoubtedly includes a person's name together with their telephone number or other information relating to their working conditions or hobbies."

In short, both the data processed to issue a duplicate E-SIM card and the E-SIM (Subscriber Identity Module) card, which unequivocally and uniquely identifies the subscriber on the network, are personal data, and their processing must be subject to data protection regulations.

This processing occurred because TME failed to verify the identity of the person requesting the duplicate E-SIM card, failed to take the necessary precautions to prevent these events from occurring, and issued the duplicate card without the intervention and knowledge of the complaining party. TME did not even comply with the protocols it has established to perform this identity verification for remote requests of this type, despite the fact that such processing is classified by TME as vulnerable.

It has been established that the duplicate E-SIM was issued and activated despite having been requested from a different email address than the one registered with the complainant in TME's O2 brand systems, without carrying out additional security checks, such as a verification call to the cardholder. The QR code was sent to a different email address than the one registered with the complainant, who has expressly denied any connection to that email address.

TME states that an additional verification call was stipulated in the entity's security policy and that it was breached by the agent who processed the request. However, it has been shown that this verification call was only mentioned in the security policy in case the applicant called from another number, and it was not explicitly specified how to proceed in the event of receiving emails from another address.

Based on the above, in the case analyzed, the diligence employed by the respondent to identify the person who requested a duplicate E-SIM card is called into question.

The issuance of duplicate E-SIM cards requires greater diligence in terms of personal data protection based on the principle of proactivity set forth in Article 24 of the GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 37/44

This principle obliges organizations to act in a way that anticipates and mitigates risks to the personal data being processed. Since the E-SIM contains sensitive information that identifies the data subject, it is crucial to verify the identity of the recipient of the QR code. The lack of adequate verification, such as sending the QR code to an email without performing additional checks, demonstrates a failure to apply this principle and calls into question the security of the personal data. Consequently, the issuance of E-SIM duplicates should incorporate additional proactive measures to ensure the identification of the holder and, thus, protect the rights of those concerned.

It should be noted, first of all, that in the response to the complaint dated July 4, 2023, "TME" reports that: "On January 16, 2023, when the request for a duplicate SIM card was submitted via number 1551, an email address had previously been changed via the customer's O2 account using the Mobile App."

And, secondly, in its response dated September 4 of the same year, the defendant acknowledged that the fraudulent duplicate had occurred, stating: "After reviewing its systems, there is no record of the request for a SIM card duplicate made over the phone. However, as the request came from a previous email request, which referred the request to 1551, there is a record of the sales agent in the customer's file detailing that the request was being processed, since the customer sent an email with the documentation regarding the customer's ID, full name, and the mobile phone number for which the request was requested. A copy of this documentation is attached as Annex 1. Furthermore, regarding the security call, it would not have occurred since the documentation would have been sent via email. However, the sales agent would not have followed the procedures outlined for this purpose with respect to the security call, which would have have been made since the request came from an email address other than the one listed in the customer file."

(...)
"At the time of the events, in the specific cases of E-SIM requests, the usual identification procedures were followed as if it were a case of a duplicate SIM card in physical format. They state that, for these types of requests, it must be verified that the E-SIM card is sent to the email address listed in their systems in the customer file.

Regarding the specific case of this claim, they indicate that, as reflected in the documentation attached as Annex 1, it can be seen that the documentation was sent by email, there is no record that the E-SIM was sent to the email address listed in the claimant's customer file."

TME acknowledges that the procedure it implemented itself was not followed, since, if it had been, the duplicate E-SIM card would have been denied.

In light of the above, the respondent fails to prove that this procedure was followed.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 38/44

Based on the foregoing, in the case analyzed, the diligence employed by the respondent to identify the person who requested a duplicate E-SIM card is called into question.

In short, the issuance of a duplicate SIM card necessarily entails the processing of personal data, since it is carried out based on the line and identity of the cardholder. Such processing must comply with a legitimate legal basis, as required by the aforementioned Article 6.1 of the GDPR, as is the case with any communication of personal data to a third party.

In this case, the issuance of the duplicate SIM card at the request of a third party without the intervention or consent of the data subject constitutes a lack of a valid legal basis for such data processing.

It should be clear that following the protocols established by TME for these procedures is not sufficient to justify the lawfulness of the processing under the GDPR, since these protocols do not satisfy the need for a legitimate basis. Furthermore, the identity verification procedure followed by TME has not adequately guaranteed compliance with the GDPR.

Therefore, the issuance of the duplicate SIM card under these conditions and its delivery to a person other than the owner of the telephone line constitutes processing of personal data without a legal basis and, consequently, a violation of Article 6.1 of the GDPR, given that it was carried out without complying with any of the legitimate grounds for such processing. Liability does not lie in the failure to comply with an internal protocol, but rather in the absence of a valid legal basis in accordance with the provisions of the GDPR.

Based on the evidence available, it is considered that the conduct of the respondent violates Article 6.1 of the GDPR, constituting the violation defined in Article 83.5.a) of the aforementioned Regulation 2016/679.

In this regard, Recital 40 of the GDPR states:

“(40) For processing to be lawful, personal data must be processed with the consent of the data subject or on another legitimate basis established by law, whether by this Regulation or by other Union or Member State law to which this Regulation refers, including the need to comply with a legal obligation applicable to the controller or the need to perform a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”

IV

Classification and qualification of the infringement

The infringement is classified in Article 83.5 of the GDPR, which states:

“5. Violations of the following provisions shall be punishable, in accordance with

section 2, by administrative fines of up to EUR 20,000,000 or,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 39/44

in the case of a company, by an amount equivalent to a maximum of 4% of the total annual global turnover of the preceding financial year, whichever is higher:

a) The basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7, and 9.”

For the purposes of the statute of limitations for the infringement, Article 72.1 of the LOPDGD classifies as a very serious infringement, with the limitation period being three years in this case: "b)
The processing of personal data without any of the conditions for the lawfulness of the processing established in Article 6 of Regulation (EU) 2016/679 being met."

V
Fine Sanction. Determination of the Amount

Determining the sanction to be imposed in this case requires observing the provisions of Articles 83.1 and 2 of the GDPR, which, respectively, provide the following:
"1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article for the infringements of this Regulation indicated in paragraphs 4, 9, and 6 are, in each individual case, effective, proportionate, and dissuasive."

“2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as a substitute for the measures provided for in Article 58(2)(a) to (h) and (j). When deciding whether to impose an administrative fine and its amount in each individual case, due account shall be taken of:

a) the nature, gravity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered by them;

b) the intentionality or negligence involved in the infringement;

c) any measures taken by the controller or processor to mitigate the damage suffered by data subjects;

d) the degree of responsibility of the controller or processor, taking into account any technical or organizational measures they have implemented pursuant to Articles 25 and 32;

e) any previous infringements committed by the controller or processor. processor;

f) the degree of cooperation with the supervisory authority in order to remedy the breach and mitigate the potential adverse effects of the breach;

g) the categories of personal data affected by the breach;

h) the manner in which the supervisory authority became aware of the breach, in particular whether the controller or processor notified the breach and, if so, to what extent;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 40/44

i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned in relation to the same matter, compliance with those measures;

j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42; and

k) any other aggravating or mitigating factors applicable to the circumstances of the case,
such as the financial benefits obtained or losses avoided, directly or

indirectly, through the infringement."

Within this section, the LOPDGDD provides in Article 76, entitled
"Sanctions and corrective measures":

"1. The sanctions provided for in sections 4, 5, and 6 of Article 83 of Regulation

(EU) 2016/679 shall be applied taking into account the grading criteria
established in section 2 of the aforementioned article.

2. Pursuant to Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account:

a) The ongoing nature of the infringement.

b) The connection between the infringer's activity and the processing of personal data.

c) The benefits obtained as a result of committing the infringement.

d) The possibility that the affected party's conduct could have led to the commission of the infringement.

e) The existence of a merger by absorption process subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity.

f) The impact on the rights of minors.

g) The availability of a data protection officer, where not mandatory.

h) Voluntary submission by the controller or processor to alternative dispute resolution mechanisms in cases where there are disputes between them and any interested party.

3. It will be possible, either complementary or alternative, to adopt, where appropriate, the remaining corrective measures referred to in Article 83.2 of Regulation (EU) 2016/679.

For the purposes of graduating the amount of the proposed fine imposed on "TME" for violating Article 6.1 of the GDPR, the following factors are considered concurrent in the present case:

- The intentionality or negligence in the violation (Article 83.2. b) of the GDPR). In this case, we are dealing with gross negligence, as the defendant sent the QR code of the E-SIM card to a different email address than the claimant's, without carrying out security checks.

In this regard, the Supreme Court ruling of October 17, 2007 (rec. 63/2006) is very illustrative, stating that "...the Supreme Court has held that negligence exists whenever a legal duty of care is disregarded, That is, when the offender does not behave with the required diligence. And in assessing the degree of diligence, the professionalism or lack thereof of the subject must be especially considered, and there is no doubt that, in the case now under examination, when the appellant's activity involves constant and extensive handling of personal data, rigor and exquisite care must be emphasized to comply with the legal provisions in this regard."

Likewise, the Supreme Court of Justice of March 1, 2024 (RCA 0001757/2021) provides that "In this regard, the Supreme Court of December 13, 2021 (Rec. 6109/2020) establishes that "(...) said contracting company is required, as necessary diligence so that it cannot be accused of breaching its obligations regarding the protection of personal data - both with regard to the requirement of consent from the interested party and with regard to the principle of truthfulness and accuracy. implementation of control and verification measures aimed at ensuring that the person intending to contract is who they claim to be, that is, that they match the holder of the DNI provided."

Thus, the data controller is required to verify the accuracy of the data subject's data by implementing appropriate measures when a contract is made. Precisely for this reason, it is necessary to ensure that the person contracting is who they claim to be, and appropriate preventive measures must be adopted to verify the identity of a person whose personal data will be processed. This is why the requirement for identification documentation is based, as the Court has reiterated, among others, in judgments of October 3, 2013 (Recital 54/2012), November 21, 2014 (Recital 45/2014), etc.

- The circumstance of Article 83.2.e) GDPR: “Any previous infringement committed by the controller or processor.”

Recital 148 of the GDPR states “In order to strengthen the application of the rules of this Regulation [...]” and indicates in this regard that “However, particular attention should be paid to the nature, gravity and duration of the infringement, its intentional nature [...] or any relevant infringement [...].”

Thus, pursuant to Article 83.2.e) GDPR, in determining the amount of the administrative fine, all previous infringements by the controller or processor may not be overlooked in order to assess the unlawfulness of the conduct under scrutiny or the culpability of the offender.

Furthermore, a correct interpretation of the provision of Article 83.2.e) GDPR cannot override the purpose pursued by the regulation: to decide the amount of the fine. the sanction of an administrative fine in the individual case raised, always ensuring that the sanction is proportional, effective, and dissuasive.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 42/44

There are numerous sanctioning procedures processed by the AEPD in which the respondent has been sanctioned for violating Article 6.1 of the GDPR:

i.EXP 202207989. Resolution issued on November 13, 2023, imposing a fine of €70,000. The facts related to a fraudulent duplicate SIM card without legal basis.

ii.EXP202211479. Resolution issued on June 13, 2023, imposing a fine of €70,000. The facts related to a fraudulent duplicate SIM card without legal basis. regarding a duplicate SIM card

fraudulent without legitimacy.

- The evident link between the defendant's business activity and the processing of personal data of clients or third parties (Article 83.2.k of the GDPR in conjunction with Article 76.2.b of the LOPDGDD).

In the course of its activities, it routinely processes personal data, which impacts the diligence required of it to comply with the principles governing the processing of personal data and the quality and effectiveness of the technical and organizational measures it must implement to ensure respect for this right.

In this regard, we can cite the SAN of 17/10/2007 (Recital 63/2006), issued during the validity of Organic Law 15/1999, but whose ruling is currently applicable, which, regarding the degree of The diligence that the controller is obliged to display in compliance with the obligations imposed by the aforementioned Organic Law, the National Court, after referring to the fact that entities whose activities involve continuous processing of client and third-party data must observe an adequate level of diligence, declares that "[...]. The Supreme Court has understood that negligence exists whenever a legal duty of care is disregarded, that is, when the offender fails to behave with the required diligence. And in assessing the degree of diligence, special consideration must be given to the professionalism or lack thereof of the subject, and there is no doubt that, in the case now under examination, when the appellant's activity involves constant and extensive handling of personal data, rigor and exquisite care must be emphasized to comply with the legal provisions in this regard."

The sanction to be imposed on the defendant must be graded and set at €200,000 for the violation of Article 6.1) as defined in Article 83.5.a) of the aforementioned GDPR.

Therefore, in accordance with applicable legislation and having assessed the criteria for grading sanctions, once the violation has been proven,

the Presidency of the Spanish Data Protection Agency RESOLVES:

FIRST: TO IMPOSE on TELEFÓNICA MÓVILES ESPAÑA, S.A. with NIF A78923125,
for a violation of Article 6.1 of the GDPR, as defined in Article 83.5 of the GDPR,
a fine of 200,000 euros (two hundred thousand euros).

SECOND: NOTIFY this resolution to TELEFÓNICA MÓVILES ESPAÑA, S.A. with Tax Identification Number (NIF) A78923125.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 43/44

THIRD: This resolution will become enforceable once the deadline for filing an optional appeal for reconsideration expires (one month from the day following notification of this resolution) without the interested party having exercised this right.
The sanctioned party is hereby notified that they must enforce the imposed sanction once this resolution becomes enforceable, in accordance with the provisions of Art. 98.1.b)
of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in Article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in conjunction with Article 62 of Law 58/2003, of December 17, by depositing the fine, indicating the NIF (Tax Identification Number) of the sanctioned party and the procedure number shown in the heading of this document, into the restricted account IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX), opened in the name of the Spanish Data Protection Agency at CAIXABANK, S.A. Otherwise, the payment will be collected during the enforcement period.

Once the notification is received and enforced, if the enforcement date is between the 1st and 15th of each month, inclusive, the deadline for making the voluntary payment will be the 20th of the following month or the next business day after that. If the payment is between the 16th and last day of each month, inclusive, the payment deadline will be the 5th of the second following month or the next business day after that.

In accordance with Article 50 of the LOPDGDD (Spanish Organic Law on the Protection of Personal Data), this Resolution will be made public once it has been notified to the interested parties.

This resolution, which terminates the administrative process pursuant to Article 50 of the LOPDGDD, may be appealed against. 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, interested parties may optionally file an appeal for reconsideration before the President of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of Article 25 and Section 5 of the Fourth Additional Provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law.

Finally, it is noted that pursuant to the provisions of Art. 90.3 a) of the LPACAP (Spanish Data Protection Act), a final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal.
If this is the case, the interested party must formally notify this fact in writing to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registries provided for in Article 16.4 of the aforementioned Law 39/2015, of October 1. They must also forward to the Agency the documentation proving the effective filing of the administrative appeal. If the Agency does not become aware of the filing of the administrative appeal within two months from the day following notification of this resolution, it will terminate the provisional suspension.

C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 44/44

Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency

C/ Jorge Juan, 6 www.aepd.es

28001 – Madrid sedeaepd.gob.es