Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

ORANGE ESPAGNE S.A.U.: Non-compliance with general data processing principles

The Spanish DPA has imposed a fine of EUR 100,000 on ORANGE ESPAGNE S.A.U..

€100,000 Fine
ORANGE ESPAGNE S.A.U.
SPAIN
Art. 5 GDPR
Personal Data Security Processing Telecommunications Supervisory Authorities
Mar 16, 2023 Source aepd.es

Full text

The Spanish DPA has imposed a fine of EUR 100,000 on ORANGE ESPAGNE S.A.U.. A customer who had purchased a cell phone from ORANGE had filed a complaint with the DPA. As a condition to deliver the cell phone, ORANGE stated that the delivery person had to take a photo of the front and back of the customer's ID card. ORANGE implemented these measures for security purposes to prevent fraud and identity theft. Despite these legitimate purposes, the DPA found that there existed far less intrusive means to the data subject´s privacy of preserving these purposes than photographing the ID card and thereby processing a variety of personal data.

Industry: Media, Telecoms and Broadcasting

How it connects

References

Related across sources

C-119/12 Judgment of the Court (Third Chamber), 22 November 2012.#Josef Probst v mr.nexnet GmbH.#Reference for a preliminary ruling from the Bundesgerichtshof.#Electronic communications — Directive 2002/58/EC — Article 6(2) and (5) — Processing of personal data — Traffic data necessary for billing and debt collection — Debt collection by a third company — Persons acting under the authority of the providers of public communications networks and electronic communications services.#Case C‑119/12. In Case C-119/12, the Court of Justice of the European Union interpreted Article 6(2) and (5) of Directive 2002/58/EC (the ePrivacy Directive) in proceedings between Josef Probst… CJEU Nov 22, 2012 Personal Data Processing Telecommunications
Us I-4772/2023-10 A utility and municipal services enterprise, Zagrebački Holding d.o.o (the controller) provided users of its services with the option to request a copy of their bill via email. Where the name appearing in the email address differed from the user’s… US Zagreb - Us I-4772/2023-10 ·Administrative Court of Zagreb Jul 22, 2026 Personal Data Retention Period Controllers
3 O 762/19 LG Rostock: Pre-ticked cookie consent boxes invalid under Art 6(1)(a) GDPR The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit… Sep 15, 2020 Consent Legitimate Interest Controllers
C-293/12 Digital Rights Ireland Ltd v Minister for Communications C-293/12 (Digital Rights Ireland) CJEU Apr 8, 2014 IP Address Storage Limitation Right to be Forgotten
C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… CJEU ·Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Supervision
C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… CJEU ·Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority
Related documents