AEPD (Spain) - PS-00456-2025

Facts }}}} The DPA fined a business support company with 80,000 euros for transferring personal data from its employees to a third party without the proper legal basis, in violation of Art. 6 (1) GDPR.The DPA fined a customer support provider €80,000 for unlawfully transferring its employees’ private phone numbers to its business customer without a valid legal basis. == English Summary ==== English Summary == === Facts ====== Facts === MAJOREL SP SOLUTIONS, S.A. (the controller) entered into an agreement with a Chinese company and a third party, under which the Controller would provide customer service activities for the Spanish market.MAJOREL SP SOLUTIONS, S.A. (the controller) entered into an agreement with a Chinese company and a third party, under which the controller would provide customer service activities for the Spanish market. On 15 January 2024, employees were informed of the existence of the agreement. However, the general contractual terms were not provided until 6 Februar