AEPD (Spain) - PS-00201-2025
From GDPRhub
| AEPD - PS-00201-2025 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 32 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 13.03.2025 |
| Decided: | |
| Published: | 17.06.2025 |
| Fine: | 1.050.000 EUR |
| Parties: | Vodafone España, S.A.U |
| National Case Number/Name: | PS-00201-2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | bms |
The DPA fined Vodafone €1,050,000 for the failure to implement adequate security measures, allowing the unlawful registration of an additional phone line and the disclosure of duplicate invoices to third parties.
English Summary
Facts
In February 2021, the data subject entered into a contract with Vodafone España, S.A.U., the controller, for the portability of two mobile phone lines. The contract included personal data such as the data subject’s name, identification number, address, email address, date of birth and bank account details.
In March 2022, the controller registered an additional mobile phone line under the data subject’s name. The controller argued that this line was validly contracted through an online signature process, involving an email and an SMS code sent to a phone number already linked to the data subject. However, the data subject denied having requested certain subsequent operations linked to that line.
On 13 July 2022, a third party contacted the controller’s customer service and requested a duplicate invoice relating to the data subject’s services. The invoice contained personal data of the data subject, including her full name, postal address and identification number. The controller sent the invoice to an email address belonging to the third party, which was not registered as an authorised contact in the data subject’s customer file.
The data subject became aware of the disclosure after receiving messages from the third party, who claimed to have obtained her personal data through the controller’s customer service. During a later call, an agent of the controller confirmed that the invoice had been sent to an email address not appearing as authorised in the customer record.
The data subject had previously requested the activation of an additional personal security code because she feared that a third party could access her personal data. According to the data subject, the controller informed her that this was unnecessary because sufficient security measures were already in place.
The controller argued that its agents were subject to a security policy and that, in principle, duplicate invoices were only sent after verification checks. However, in this case, the agent processing the request did not complete the final SMS verification step required to access the invoice through a URL link.
The DPA initially archived the complaint. After the data subject appealed, the DPA upheld the appeal and initiated sanctioning proceedings against the controller.
Holding
Violation of Article 6(1) GDPR
The DPA held that the controller violated Article 6(1) GDPR by registering an additional mobile phone line in the data subject’s name without sufficiently proving that the processing had a valid legal basis.
The DPA noted inconsistencies in the documentation submitted by the controller, including different order numbers and different email addresses. It also considered that the controller had not demonstrated that the disputed line had been lawfully contracted by the data subject.
The DPA further held that the controller violated Article 6(1) GDPR by modifying the data subject’s contact details and sending a duplicate invoice to a third party.
The invoice contained personal data of the data subject and was sent to an unauthorised email address. The DPA considered that the controller had no valid legal basis for this disclosure. The fact that a third party may have impersonated the data subject did not release the controller from its obligation to ensure that personal data were processed lawfully.
Violation of Article 32 GDPR
The DPA also held that the controller violated Article 32 GDPR by failing to implement appropriate technical and organisational measures.
The controller’s security policy was insufficient in practice, since it allowed a third party to modify contact details and obtain a duplicate invoice containing personal data. The DPA also stressed that the controller had not ensured the effective application of its own verification process, as the final SMS verification step was not completed.
The DPA rejected the argument that the incident resulted only from the conduct of a third party or from an isolated mistake by a customer service agent. Given the controller’s business activity and the volume and nature of customer data processed, the DPA considered that the controller was required to apply a particularly high level of diligence.
Fine and corrective measures
The DPA imposed three administrative fines: €150,000 for the unlawful registration of the additional line, €150,000 for the unlawful modification of contact details and disclosure of the duplicate invoice, and €750,000 for the infringement of Article 32 GDPR. The total fine amounted to €1,050,000.
In addition, under Article 58(2)(d) GDPR, the DPA ordered the controller to bring its processing operations into compliance within six months from the finality of the decision. In particular, the controller had to adopt appropriate measures to prevent third parties from contracting services in the name of customers, obtaining duplicate invoices or modifying customer contact details.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/20 • File No.: EXP202313830 RESOLUTION TERMINATING THE PROCEEDINGS BY ACKNOWLEDGMENT OF LIABILITY AND VOLUNTARY PAYMENT From the proceedings initiated by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On May 21, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against SILVANERGIA 2022, S.L. (hereinafter, SILVANERGIA), by means of the agreement transcribed below: << File No.: EXP202313830 AGREEMENT TO INITIATE SANCTIONING PROCEEDINGS Based on the actions taken by the Spanish Data Protection Agency and on the following FACTS FIRST: On August 22, 2023, a complaint was filed with the Spanish Data Protection Agency regarding a possible infringement attributable to SILVANERGIA 2022, S.L., with Tax Identification Number B72658313 (hereinafter, SILVANERGIA or the respondent). The following facts are brought to the attention of this authority: The complainant states that on August 16, 2023, an agent of the company being sued contacted by telephone and informed her that they were calling from Bassols Energía, the energy supplier that manages her contract with Naturgy, to update her tariff according to the new regulations published by the government. The agent told her that the process was very quick because they already had all her information and only needed to confirm it. In fact, the agent listed her full name, national identity document number, address, CUP number, and the 12 digits of her bank account number. The agent indicated that, due to data protection regulations, the full account number could not be given over the phone and urged her to complete it, supposedly for verification purposes, which the complainant did. Subsequently, they sent her a contract in the name of Bassols Energía via the email addresses “***EMAIL.1” and “***EMAIL.2” with the subject line “IMPORTANT! Reminder: Signature pending Bassols Energía (CERTIFIED EMAIL from ***EMAIL.1.1)”. Once the complainant opened the email, she received a call notifying her that she would receive an SMS with a code to sign the contract. The complainant did not sign the contract. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/20 upon realizing that the company was not acting as her electricity provider, but rather intended to set up a new contract. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/20 When the company contacted the claimant again the following day, to inquire why she had not signed, she asked where they had obtained all her data and was told that it had been obtained from companies “of the type (...)”. The claimant stated that she had not given any information to such companies and asked again where they had obtained the data so that she could exercise her right of withdrawal. When she attempted to contact the company again, both the email address and the telephone number used up to that point appeared to be nonexistent. Therefore, she contacted Bassols Energía, S.A., using the phone number listed on the website to request the deletion of her personal data. The response she received was that the company had been the victim of identity theft, that the contract they had sent her was fake, and that the theft had already been reported. SECOND: In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the aforementioned complaint was forwarded to Bassols Energía, S.A. so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements established in the data protection regulations. On November 16, 2023, a response was received from the company stating that BASSOLS ENERGIA, S.A. is part of a business group that includes an electricity trading company, BASSOLS ENERGIA COMERCIAL, SL, which deals with residential end customers. The company believes the request may have been directed to this company and, as a gesture of cooperation, is responding to the request on behalf of this trading company. In its written statement, the company indicates that it contracted the services of companies dedicated to promoting activities related to the marketing of electricity, but that these contracts expressly stipulated that these companies had their own client base, or the capacity to generate one, to which they would offer the products marketed by BASSOLS ENERGIA COMERCIAL, SL. In short, these companies acted independently as commercial agents. Furthermore, with respect to the claimant, BASSOLS ENERGIA COMERCIAL, SL states that it is not registered as a client, nor has it ever been, and that the telephone calls it alleges to have received from this entity do not correspond to the supplier's telephone numbers. THIRD: On November 22, 2023, in accordance with Article 65 of the LOPDGDD (Spanish Organic Law on Data Protection and Digital Rights), the claim was admitted for processing. FOURTH: The Deputy Directorate General for Data Inspection carried out preliminary investigative actions to clarify the facts in question, pursuant to the functions assigned to supervisory authorities in Article 57.1 and the powers granted in Article 58.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and in accordance with the provisions of Title VIII of the Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 3/20 As a result of the actions taken, the following facts have been established: - Through information obtained from the numbering registry on the CNMC website, https://numeracionyoperadores.cnmc.es/portabilidad/fija (document “Procedure 2”), it was verified that, as of the date of the investigation of this case, the operator of the originating number was: ***TELEPHONE.1 GAMMA OPERADORA DE COMUNICACIONES, S.A. Regarding the disputed number ***TELEPHONE.1: - In a response dated March 15, 2024, and registration number REGAGE24e00020140422, NEOTEL 2000 S.L.U. (a subsidiary of GAMMA) indicates that the line owner on the date of the call to the complainant was SILVANERGIA 2022 S.L.U. and confirms that two calls were made at 12:19:44 and 19:00:28. TELEFÓNICA (the claimant's phone operator) also confirms receipt of the calls. A request for information regarding the reasons for the calls was sent to SILVANERGÍA on March 18, 2024, but it expired. A follow-up request was sent by mail on November 8, 2024, and the following response was received on December 10, 2024: “… In response to your information request received on November 22, 2024, regarding file EXP202313830, we are writing to provide you with the requested information. 1. Confirmation of calls made to the number ***TELÉFONO.2 on August 16, 2023, between 12:00 and 20:00: - We cannot confirm the calls made to said number on the aforementioned date. Our call center only keeps records of calls made within the last year. 2. Reason for the call to the telephone number ***TELÉFONO.2: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 4/20 - We cannot confirm that the call was made, as we do not have the call log for the date mentioned. 3. Contractual relationship with BASSOLS ENERGÍA COMERCIAL, S.L.: - Our company had a contractual relationship with BASSOLS ENERGÍA COMERCIAL, S.L. in the past, providing telemarketing services for them. However, we currently have no contractual relationship with this company. 4. Contractual relationship with AURORA ENERGY 2000, SLU: - Our company has never had a contractual relationship with AURORA ENERGY 2000, SLU. 5. Contractual relationship with GESTION DE VENTAS IBERIA, SL: - Our company has never had a contractual relationship with GESTION DE VENTAS IBERIA, SL. 6. How do you receive the numbers? Which numbers should be used for business calls: - The phone numbers we call are provided by several providers. These providers are responsible for filtering these numbers using the Robinson List. 7. Confirmation of consulting any list of numbers that should not be called: - As mentioned in the previous section, the providers guarantee Robinson filtering of any record. However, for the past few months, to ensure compliance with current data protection regulations, we have been performing a second Robinson filter from the call center. This filtering is automatic and continuous, preventing calls from being made to numbers on the Robinson List. SILVANERGÍA was asked to sign a collaboration agreement with BASSOLS ENERGÍA COMERCIAL. In response, dated January 31, 2025, we received an unsigned and unfilled contract template. On February 3, 2025, a further request was sent to SILVANERGIA requesting a signed contract with BASSOLS ENERGÍA COMERCIAL. A response was received dated February 17, 2025, attaching what appears to be a "Promotional Services Agreement," which includes the following information: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 5/20 - The details of the alleged representative of BASSOLS ENERGÍA COMERCIAL are included, and the only identifying information provided by the COLLABORATOR is the name "A.A.A." and the address "***DIRECCIÓN.1". - On one side appears “BASSOLS ENERGÍA COMERCIAL” and on the other “VICO FINANCIAL SERVICES” (the COLLABORATOR). It can be observed in document “Diligencia 4” that the latter has no connection with SILVANERGIA 2020, S.L. - Only one signature appears (with a digital signature certificate included at the end of the document) of the COLLABORATOR, and the signature of the representative of BASSOLS ENERGÍA COMERCIAL is not found anywhere in the document. On February 18, 2025, SILVANERGIA was asked for the following information: - Specify which specific personal data provider supplied the claimant's data, and provide evidence of such a transaction, including the date it occurred. - Copy of the agreement signed with said personal data provider and, where applicable, the other documents that establish the guidelines regarding the conditions for the legitimacy of said transaction. To which, on February 18, 2025, SILVANERGIA responded by attaching an invoice from provider ***PROVEEDOR.1 ((...)) dated June 10, 2023 (a date prior to the call to the claimant). It did not attach any evidence that the data acquired from said provider was obtained legitimately. On January 20, 2025, BASSOLS ENERGÍA COMERCIAL was asked to establish a contractual relationship with SILVANERGIA, to which they responded on February 4, 2025: “…… II. As of today, the marketing company, BASSOLS ENERGIA COMERCIAL, SL, has no commercial relationship whatsoever with SILVANERGIA 2022, SL. However, in July 2023, they entered into commercial discussions with the aim of collaborating professionally. The purpose of this collaboration was for SILVANERGIA 2022, SL C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 6/20 to act as an external channel, acquiring potential clients for BASSOLS ENERGIA COMERCIAL, SL. III. Anticipating a potential collaboration, BASSOLS ENERGIA COMERCIAL, SL sent a Collaboration Agreement which was never returned or signed by SILVANERGIA 2022, SL, despite repeated requests from the aforementioned company, given that it was not considered advisable to begin collaborating without a duly signed contract. Similarly, BASSOLS ENERGIA COMERCIAL, SL requested financial information from SILVANERGIA 2022, SL to verify the financial standing of the company with which they were considering collaborating. IV. At the end of August 2023, as a result of not having received the signed contract and SILVANERGIA 2022, SL being found to have an irregular financial situation, BASSOLS ENERGIA COMERCIAL, SL decided to sever all business ties with SILVANERGIA 2022, SL. V. As a consequence of the above, BASSOLS ENERGIA COMERCIAL, SL and SILVANERGIA 2022, SL never formalized a written contract. However, this party is aware that SILVANERGIA 2022, SL began soliciting potential clients for BASSOLS ENERGIA COMERCIAL, SL during the months of July and August 2023. Even without a signed contract, SILVANERGIA 2022, SL may have attempted to acquire clients for BASSOLS ENERGIA COMERCIAL, SL. VI. For clarification purposes, BASSOLS ENERGIA COMERCIAL, SL never transferred any personal data of clients to SILVANERGIA 2022, SL, since according to internal protocol, data is only shared with partner companies when the corresponding confidentiality agreement has been signed between the Data Controller and the Data Processor. FIFTH: According to the report obtained from the AXESOR tool, the entity SILVANERGIA is a company incorporated in 2022, with a turnover of €149,570 in 2023. LEGAL BASIS I Jurisdiction In accordance with the powers granted to each supervisory authority by Article 58.2 of the GDPR and as established in Articles 47, 48.1, 64.2, and 68.1 of the LOPDGDD, the Presidency of the Spanish Data Protection Agency is competent to initiate and resolve this procedure. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 7/20 II Procedure Likewise, Article 63.2 of the LOPDGDD (Spanish Data Protection Law) establishes that: “The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures.” In accordance with Article 64 of the LOPDGDD, and taking into account the characteristics of the alleged infringement, a sanctioning procedure is initiated. The procedure will have a maximum duration of twelve months from the date of the initiation agreement. After this period, the proceedings will expire and, consequently, the case file will be closed, in accordance with Article 64 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights). If no objections are raised to this initial agreement within the stipulated period, it may be considered a proposed resolution, as established in Article 64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP). III Preliminary Issues Article 4.1 of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” Article 4.2 of the GDPR defines "processing" as: "any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction." Article 4.7 of the GDPR defines "controller" as: "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be laid down by Union or Member State law." Article 4.8 of the GDPR defines the "data processor" as the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 8/20 natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. In this case, in accordance with Articles 4.1 and 4.2 of the GDPR, personal data processing is taking place, since SILVANERGIA carries out, among other processing activities, the collection, storage, consultation, and use of personal data of natural persons, such as name and surname, national identity document number, address, and bank account numbers, among others. SILVANERGIA carries out this activity in its capacity as data controller, since it is the one that determines the purposes and means of such activity pursuant to Article 4.7 of the GDPR. It should be noted that a written data processing agreement was never formalized between BASSOLS ENERGIA COMERCIAL, SL and SILVANERGIA 2022, SL. IV. Breach of Obligation. Lawfulness of Processing Article 6, paragraph 1 of the GDPR states the following: "1. Processing shall be lawful only if at least one of the following conditions applies: a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; c) processing is necessary for compliance with a legal obligation to which the controller is subject; d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject." require the protection of personal data, particularly when the data subject is a child. The provisions of point (f) of the first paragraph shall not apply to processing carried out by public authorities in the exercise of their functions. Recital 40 of the GDPR states that "For processing to be lawful, personal data must be processed with the data subject's consent or on another legitimate ground established in accordance with the law, whether in this Regulation or by virtue of other Union or Member State law to which this Regulation refers, including the need to comply with a legal obligation to which the controller is subject or the need to perform a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract." C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 9/20 to which the data subject is a party The processing of personal data requires a legal basis that legitimizes it. In this case, SILVANERGIA, in July 2023, initiated commercial discussions with the aim of acting as a lead generator for BASSOLS ENERGIA COMERCIAL, SL. However, for the reasons previously explained in the research activities, a written contract was not formalized. It is worth recalling in this regard that, in accordance with Article 28.3 of the GDPR 3. Processing by the processor shall be governed by a contract or other legal act under Union or Member State law which binds the processor to the controller and sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and categories of data subjects, and the rights and obligations of the controller. Such a contract or legal act shall stipulate, in particular, that the Processor: (a) shall process personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such case, the processor shall inform the controller of that legal requirement prior to processing, unless such law prohibits such processing for important reasons of public interest; (b) shall ensure that persons authorized to process personal data have undertaken to respect confidentiality or are subject to a statutory obligation of confidentiality; (c) shall take all necessary steps pursuant to Article 32; (d) shall comply with the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) shall assist the controller, taking into account the nature of the processing, through of appropriate technical and organizational measures, where possible, to enable the controller to comply with its obligation to respond to requests for the exercise of the data subjects' rights set out in Chapter III; C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 10/20 f) assist the controller in ensuring compliance with the obligations set out in Articles 32 to 36, taking into account the nature of the processing and the information available to the processor; g) at the controller's option, delete or return all personal data once the processing services have ended, and delete existing copies unless retention of the personal data is required under Union or Member State law; h) make available to the controller all the information necessary to demonstrate compliance with the obligations set out herein article, as well as to allow and contribute to the performance of audits, including inspections, by the controller or another auditor authorized by the controller. With regard to point (h) of the first paragraph, the processor shall inform the controller immediately if, in its opinion, an instruction infringes this Regulation or other data protection provisions of the Union or Member States. Despite not having this contract, SILVANERGIA made attempts to acquire clients for BASSOLS ENERGIA COMERCIAL, SL. These commercial activities carried out by the defendant company were performed without being covered by any contract with BASSOLS ENERGIA COMERCIAL, SL., that is, the telephone calls made to the complainant with the aim of acquiring them as a client were not authorized under Article 6.1 of the GDPR. Furthermore, BASSOLS ENERGIA COMERCIAL, SL states that it did not transfer any personal data of any of its clients to the company being complained against, as there was no confidentiality agreement between the data controller and the data processor. In response to this Agency's request for information from SILVANERGIA regarding the personal data provider that supplied the complainant's data, SILVANERGIA attached an invoice from supplier ***PROVEEDOR.1, dated June 10, 2023, prior to the call to the complainant. The invoice states that 10,000 customer records were sold to SILVANERGIA and indicates "Own clients with C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 11/20 acceptance of transfer and sale to third parties." However, SILVANERGIA did not provide a copy of the signed agreement with the data provider or any document establishing the legal basis for the transaction. It is In other words, the complainant has not demonstrated that the data acquired from the supplier company was obtained lawfully and with the consent of the data subjects. This processing, without proper authorization, implies an unlawful processing of the complainant's personal data and, consequently, a presumed violation of Article 6.1 of the GDPR. Therefore, in accordance with the evidence available at this time, and in accordance with the initiation of sanction proceedings, it is considered that the known facts could constitute an infringement attributable to SILVANERGIA for a violation of the aforementioned article. V Classification of the infringement of Article 6.1 of the GDPR and its classification for the purposes of the statute of limitations Article 83.5 of the GDPR classifies the violation of the following article as an administrative infringement, which will be sanctioned, in accordance with paragraph 2, with administrative fines of A maximum of EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total global annual turnover of the preceding financial year, whichever is higher: "(a) the basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7 and 9;" For its part, the LOPDGDD, in its Article 71, Infringements, states that: "The acts and conduct referred to in paragraphs 4, 5 and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute infringements." For the sole purpose of the limitation period, Article 72.1 of the LOPDGDD establishes the following: "Based on the provisions of Article 83.5 of Regulation (EU) 2016/679 are considered very serious and will be subject to a three-year statute of limitations for infringements that constitute a substantial breach of the articles mentioned therein and, in particular, the following: b) The processing of personal data without any of the conditions of lawfulness of processing established in Article 6 of Regulation (EU) 2016/679 being met." VI Proposed Sanction C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 12/20 In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed, which state: “1. Each supervisory authority shall ensure that the imposition of administrative fines under this Article for infringements of this Regulation referred to in paragraphs 4, 9, and 6 is, in each individual case, effective, proportionate, and dissuasive. 2. Administrative fines shall be imposed, depending on the circumstances of each individual case, as an additional measure to, or in lieu of, the measures provided for in Article 58(2)(a) to (h) and (j). In deciding on the imposition of an administrative fine and its amount in each individual case, due consideration shall be given to: (a) the nature, seriousness, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered; (b) whether the infringement was intentional or negligent; (c) any measures taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures implemented pursuant to Articles 25 and 32; (e) any prior infringements committed by the controller or processor; (f) the degree of cooperation with the supervisory authority with a view to remedying the infringement and mitigating its possible adverse effects; (g) the categories of personal data affected by the infringement; (h) how the supervisory authority became aware of the infringement, in particular whether and, if so, to what extent the controller or processor notified the infringement; (i) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; (j) adherence to codes of conduct pursuant to Article 40 or to approved certification mechanisms pursuant to Article 42, and (k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.” For its part, Article 76 “Sanctions and Corrective Measures” of the LOPDGDD (Spanish Data Protection Law) stipulates: “1. The sanctions provided for in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity of the sanction established in paragraph 2 of said Article. 2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The continuing nature of the infringement. b) The connection between the infringer's activity and the processing of personal data. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 13/20 c) The benefits obtained as a consequence of committing the infringement. d) The possibility that the data subject's conduct could have induced the Commission of the infringement. e) The existence of a merger by acquisition subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity. f) The impact on the rights of minors. g) The appointment of a data protection officer, when not mandatory. h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in cases where disputes arise between them and any data subject. In this case, considering the seriousness of the potential infringement, and paying particular attention to the consequences of its commission for those affected, a fine would be appropriate, in addition to the adoption of measures, if applicable. The fine imposed must be, in each individual case, effective, proportionate, and dissuasive, in accordance with Article 83.1 of the GDPR. To guarantee these principles, the turnover of SILVANERGIA (…) euros in 2023 is considered beforehand. For the purposes of deciding on the imposition of an administrative fine and its amount, in accordance with the evidence available at this time of the initiation of the sanctioning procedure, and without prejudice to the outcome of the investigation, it is considered appropriate to determine the sanction to be imposed according to the following circumstances, as set forth in the aforementioned provisions. As a preliminary matter, the following circumstances are considered to exist: - The nature, seriousness, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the level of damage and harm they have suffered (Article 83.2(a) of the GDPR): it should be noted here that the defendant acted as a client recruiter without being covered by any contract, and therefore the infringement would not affect only the complainant. - The intent or negligence in the infringement (Article 83.2(b) of the GDPR): gross negligence is manifested in the use of the personal data of the data subjects without having obtained it directly from them and without informing them that their personal data is being processed. - The categories of personal data affected by the infringement (Article 83.2, letter g), of the GDPR): because data that has the capacity to unequivocally identify a person has been exposed, such as C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 14/20 data from the National Identity Document (DNI), and which may be susceptible to misuse, such as identity theft, among others. In this regard, the European Data Protection Board (EDPB) itself, in its guidelines on calculating fines, adopted in May 2023, states the following (emphasis added): Regarding the requirement to take into account the categories of personal data concerned [Article 83(2)(g) of the GDPR], the GDPR clearly highlights the types of data that deserve special protection and, therefore, a stricter response with regard to fines. This refers, at a minimum, to the types of data covered by Articles 9 and 10 of the GDPR and to data outside the scope of these articles whose disclosure would cause immediate harm to the data subject (for example, location data, data on private communications, national identification numbers, or financial data, such as transaction summaries or credit card numbers). In general, the more of these categories of data involved or the more sensitive the data, the more weight the supervisory authority may give to this factor. The following factors are also considered aggravating circumstances: - The connection of the infringer's activity with the processing of personal data (Article 76.2(b) of the LOPDGDD): The defendant provides customer acquisition services, and therefore, in the course of its business, it routinely needs to process personal data. For the purposes of deciding on the imposition of an administrative fine and its amount, in accordance with the evidence available at this time of the agreement to initiate sanctioning proceedings, and without prejudice to the outcome of the investigation, it is considered that the balance of the circumstances contemplated in Article 83.2 of the GDPR and Article 76.2 of the LOPDGDD, with respect to the infringement committed by violating the provisions of Article 6.1 of the GDPR, allows for the initial imposition of an administrative fine of €5,000.00. IX Adoption of Measures If the infringement is confirmed, the resolution issued may establish the corrective measures that the infringing entity must adopt to end the non-compliance with personal data protection legislation, in this case Article 6.1 of the GDPR, in accordance with the provisions of Article 58.2(d) of the GDPR, according to which each supervisory authority may “require the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time frame…”. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 15/20 Thus, the responsible entity may be required to adapt its actions to the personal data protection regulations, to the extent expressed in the preceding Legal Basis. This document establishes the alleged infringement and the facts that could give rise to this possible violation of data protection regulations, clearly outlining the measures to be adopted. However, the specific procedures, mechanisms, or instruments for implementing these measures are the responsibility of the sanctioned party, as it is the data controller who fully understands their organization and must decide, based on proactive responsibility and a risk-based approach, how to comply with the GDPR and the LOPDGDD. However, in this case, notwithstanding the foregoing, in accordance with the evidence currently available regarding the initiation of disciplinary proceedings, the resolution adopted may require SILVANERGIA to, within a maximum period of one month from the date of enforceability of the final resolution of these proceedings, adopt the following measure: - Cease the processing of personal data in its customer acquisition activities, unless such processing is based on one of the legal grounds set forth in Article 6.1 of the GDPR. The imposition of this measure is compatible with the sanction of an administrative fine, as provided for in Article 83.2 of the GDPR. Please be advised that failure to comply with any order to adopt measures imposed by this agency in the resolution of this sanctioning procedure may be considered an administrative infringement in accordance with the GDPR, specifically classified as an infringement in Articles 83.5 and 83.6, and such conduct may lead to the initiation of further administrative sanctioning proceedings. Furthermore, please note that neither acknowledgment of the infringement committed nor, where applicable, voluntary payment of the proposed amounts, exempts you from the obligation to adopt the necessary measures to cease the conduct or correct the effects of the infringement committed, and from the obligation to demonstrate compliance with this obligation to the Spanish Data Protection Agency (AEPD). Therefore, in light of the foregoing, the President of the Spanish Data Protection Agency hereby resolves: FIRST: To initiate sanctioning proceedings against SILVANERGIA 2022, S.L., with Tax Identification Number (NIF) B72658313, for the alleged infringement of Article 6.1 of the GDPR, as defined in Article 83.5 of the GDPR. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 16/20 SECOND: To appoint B.B.B. as investigating officer and C.C.C. as secretary. indicating that they may be challenged, if applicable, in accordance with the provisions of Articles 23 and 24 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector (LRJSP). THIRD: TO INCORPORATE into the file, for evidentiary purposes, the claim filed by the claimant and its documentation, as well as the documents obtained and generated by the General Sub-Directorate of Data Inspection in the actions prior to the commencement of these disciplinary proceedings. FOURTH: THAT for the purposes provided for in Article 64.2 b) of the LPACAP law, the applicable sanction would be an administrative fine of €5,000.00, without prejudice to the outcome of the investigation. FIFTH: NOTIFY SILVANERGIA 2022, S.L., with Tax Identification Number (NIF) B72658313, of this agreement, granting it a period of ten business days to submit any allegations and present any evidence it deems appropriate. In its written allegations, it must provide its Tax Identification Number (NIF) and the procedure number shown in the heading of this document. In accordance with the provisions of Article 85 of the LPACAP (Law on Administrative Procedure of Public Administrations), it may acknowledge its responsibility within the period granted for submitting allegations to this initiation agreement; this will entail a 20% reduction of the penalty to be imposed in this procedure. With the application of this reduction, the penalty would be set at €4,000.00, and the procedure will be resolved with the imposition of this penalty. Likewise, you may, at any time prior to the resolution of these proceedings, make voluntary payment of the proposed penalty, which will result in a 20% reduction. With this reduction, the penalty will be set at €4,000.00, and payment will terminate the proceedings, without prejudice to the imposition of any other applicable measures. The reduction for voluntary payment of the penalty is cumulative with the reduction applicable for acknowledging responsibility, provided that this acknowledgment is made within the period granted for submitting arguments upon the initiation of the proceedings. The voluntary payment of the amount referred to in the preceding paragraph may be made at any time prior to the resolution. In this case, if both reductions were to be applied, the penalty amount would be set at €3,000.00. In any case, the effectiveness of either of the aforementioned reductions will be conditional upon the withdrawal or waiver of any administrative action or appeal against the sanction. Should you choose to make a voluntary payment of either of the amounts mentioned above (€4,000.00 or €3,000.00), you must do so by depositing the funds into account number IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX) held in the name of the Spanish Data Protection Agency at CAIXABANK, S.A., indicating in the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 17/20 the reference number of the procedure shown in the header of this document and the reason for the reduction in the amount you are applying for. You must also send proof of payment to the General Sub-Directorate of Inspection to continue with the procedure in accordance with the amount paid. In compliance with Articles 14, 41, and 43 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), please be advised that, henceforth, all notifications sent to you will be made exclusively electronically, through the Single Authorized Electronic Address (dehu.redsara.es) and the Electronic Office (sedeaepd.gob.es). Failure to access these notifications will result in a record of your rejection in the file, thus completing the process and continuing the procedure. You are informed that you may provide this Agency with an email address to receive notifications when they are available, and that failure to respond to this notification will not invalidate the notification. Finally, it should be noted that, in accordance with Article 112.1 of the LPACAP (Law on Administrative Procedure and Common Administrative Procedure), no administrative appeal may be lodged against this decision. 110425-260325 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency >> SECOND: On June 4, 2025, SILVANERGIA paid the fine in the amount of €3,000.00, taking advantage of the two reductions provided for in the initial agreement transcribed above. This implies acknowledgment of responsibility in relation to the facts referred to in the initial agreement and their legal classification. THIRD: The initial agreement transcribed above indicated that, should the infringement be confirmed, the controller could be ordered to adopt appropriate measures to bring its actions into compliance with the regulations mentioned in this act, in accordance with Article 58.2(d) of the GDPR, which states that each supervisory authority may "require the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time frame...". Having acknowledged responsibility for the infringement, the measures included in the initial agreement should be imposed. LEGAL BASIS I Jurisdiction C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 18/20 In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure. Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) stipulates that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, subsidiarily, by the general rules on administrative procedures." II Termination of the Procedure Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), under the heading “Termination of Sanctioning Procedures,” provides the following: “1. Once a sanctioning procedure has been initiated, if the offender acknowledges their responsibility, the procedure may be resolved by imposing the corresponding sanction. 2. When the sanction is solely monetary, or when a monetary sanction and a non-monetary sanction are applicable but the inappropriateness of the latter has been justified, voluntary payment by the alleged offender, at any time prior to the resolution, will imply the termination of the procedure, except with regard to restoring the altered situation or determining compensation for the damages caused by the commission of the infraction. 3. In both In cases where the sanction is solely monetary, the competent body for resolving the proceedings shall apply reductions of at least 20% to the proposed sanction amount, and these reductions may be combined. These reductions must be specified in the notification initiating the proceedings, and their effectiveness is conditional upon the withdrawal or waiver of any administrative action or appeal against the sanction. The percentage reduction provided for in this section may be increased by regulation. III Voluntary Payment and Acknowledgment of Responsibility In accordance with the provisions of Article 85 of the LPACAP, the notified initiation agreement informed the appellant of the possibility of acknowledging responsibility and making voluntary payment of the proposed sanction, which would entail two cumulative reductions of 20% each. With the application of these two reductions, the penalty would be set at €3,000.00, and its payment would imply: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 19/20 the termination of the proceedings, without prejudice to the imposition of the corresponding measures. Following notification of the aforementioned initiation agreement, SILVANERGIA has acknowledged responsibility and voluntarily paid the penalty, taking advantage of the two reductions provided for. In accordance with section 3 of Article 85 of the LPACAP (Law on Administrative Procedure), the effectiveness of these reductions is conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. It should be noted that, in accordance with the provisions of the LPACAP (Law on Administrative Procedure of Public Administrations), as well as the jurisprudence of the Supreme Court on this matter, the exercise of voluntary payment by the alleged offender does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Likewise, Article 88 of the aforementioned law establishes that the resolution that concludes the proceedings will decide all issues raised by the interested parties and any other issues arising therefrom. Therefore, in accordance with the applicable legislation and having assessed the criteria for determining the severity of the sanctions, the Presidency of the Spanish Data Protection Agency resolves: FIRST: To declare the commission of the infringements and to confirm the sanctions determined in the operative part of the initial agreement transcribed in this resolution. The sum of the aforementioned amounts totals €5,000.00. Following SILVANERGIA 2022, S.L.'s prompt payment and acknowledgment of liability, pursuant to Article 85 of the LPACAP (Law on Administrative Procedure of Public Administrations), a 40% reduction of the aforementioned total is applied, resulting in a final amount of €3,000.00. The effectiveness of these reductions is conditional upon the withdrawal or waiver of any administrative action or appeal. SECOND: DECLARE the termination of procedure EXP202313830, in accordance with the provisions of Article 85 of the LPACAP. THIRD: ORDER SILVANERGIA 2022, S.L. so that within one month from the date this resolution becomes final and enforceable, you notify the Agency of the adoption of the measures described in the legal grounds of the initiation agreement transcribed in this resolution. FOURTH: NOTIFY SILVANERGIA 2022, S.L. of this resolution. FIFTH: In accordance with the provisions of Article 85 of the LPACAP, which conditions the reduction for voluntary payment and acknowledgment of liability on the withdrawal or waiver of any action or appeal through administrative channels, this resolution will become final through administrative channels and fully enforceable upon its notification. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 20/20 In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which ends the administrative process as stipulated by art. Pursuant to Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, interested parties may file an appeal with the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law. However, in accordance with the provisions of Article 90.3.a) of the LPACAP, the final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal. If this is the case, the interested party must formally notify the Spanish Data Protection Agency in writing, submitting it through the Agency's Electronic Registry [https://sedeaepd.gob.es/sede-electronica-web/], or through any of the other registries provided for in Article 16.4 of Law 39/2015 of October 1. They must also provide the Agency with documentation proving the effective filing of the administrative appeal. If the Agency does not receive notification of the filing of the administrative appeal within two months from the day following notification of this resolution, the precautionary suspension will be terminated. 1259-260325 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency 6 Jorge Juan Street www.aepd.es 28001 – Madrid sedeaepd.gob.es
