Xfera Moviles S.A. – €39,000 Fine (Spain, 2020)

€39,000

Agencia Española de Protección de Datos

9 June 2020

Spain

final

Fine

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

Xfera Moviles was fined €39,000 after sending an SMS to the wrong customer about a missed payment and service suspension. The company failed to protect personal data, leading to confusion and privacy issues.

What happened

Xfera Moviles sent an SMS about a missed payment to the wrong customer, causing a privacy breach.

Who was affected

The affected individuals were customers who received incorrect SMS notifications about account issues.

What the authority found

The Spanish Data Protection Authority fined Xfera Moviles for not ensuring the confidentiality and accuracy of personal data, violating GDPR.

Why this matters

This case underscores the importance of data accuracy and confidentiality. Companies should double-check customer information before sending sensitive communications to avoid privacy breaches and fines.

GDPR Articles Cited

Automatically processed

Art. 5(1)(f) GDPR

View original scraped data

Art. 5(1) f) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

Source checks

Linked-source text retrieved.

Automated check recorded — 12 March 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Spain enforcement Agencia Española de Protección de Datos actions All Xfera Moviles S.A. actions

Full Legal Summary

Detailed

A customer claimed to have received an SMS from Xfera Móviles informing about the non-payment and the resulting suspension of the service in relation to the account of another data subject.

Show full summary

Related Enforcement Actions (15)

Other enforcement actions involving Xfera Moviles S.A. in ES

Oct 2019· Agencia Española de Protección de Datos

Xfera Movile has used personal data without a legal basis for the conclusion of a telephone contract and has continued to process personal data even w...

Nov 2019· Agencia Española de Protección de Datos

An individual complainant had received an SMS from Xfera Móviles which was to be addressed to a third party and which allowed him to access the accoun...

Feb 2020· Agencia Española de Protección de Datos

According to the data protection authority, XFERA MOVILES has violated Article 6(1) of the GDPR, as the company has unlawfully processed data, includi...

Feb 2020· Agencia Española de Protección de Datos

The AEPD found that a third party had access to the name, telephone number and address of another customer.

Mar 2020· Agencia Española de Protección de Datos

The company did not provide the data protection authority with the requested information in a timely manner. The AEPD's request was preceded by a requ...

Current

Jun 2020

Fine

€39K

Jun 2020· Agencia Española de Protección de Datos

The data subject received a notice from a debt collection company demanding payments in connection with Xfera Móviles' services, even though the claim...

Jul 2020· Agencia Española de Protección de Datos

The company had not cooperated sufficiently with the data protection authority.

Jul 2020· Agencia Española de Protección de Datos

The company had changed a contract for a mobile phone connection to a new owner, whereby the personal data of a data subject such as his address and t...

Jul 2020· Agencia Española de Protección de Datos

A data subject had received a call from another Xfera Móviles customer who stated that the company had charged his bank account with an invoice, discl...

Jul 2020· Agencia Española de Protección de Datos

Following a complaint, Xfera Móviles was requested by the AEPD to submit certain information and documents, but did not do so within the provided time...

Sept 2020· Agencia Española de Protección de Datos

Failure to remove the data subject's personal data at the time of cancellation of his/her telephone services contract and sending a warning to the dat...

Nov 2020· Agencia Española de Protección de Datos

Xfera Móviles had failed to cooperate with the AEPD in the investigation of privacy violations. Xfera Móviles had neither responded to the request for...

Dec 2020· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) imposed a fine on Xfera Móviles, S.A. due to insufficient legal basis for data processing. The data subject states that two tel...

Feb 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) imposed a fine of EUR 40,000 on Xfera Móviles S.A.. The data subject claimed a violation of its right to information to the AEP...

Mar 2021· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) imposed a fine of EUR 150,000 on Xfera Móviles S.A.. The DPA had received two complaints from a data subject. The first complai...

Details

Fine Date

9 June 2020

Authority

Agencia Española de Protección de Datos

Fine Amount

€39,000

Sources

About this data

Data: CMS GDPR Enforcement Tracker

Licensed under CC BY-NC-SA 4.0

Automatically normalized and classified

Cite as: Cookie Fines. Xfera Moviles S.A. - Spain (2020). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: 4 May 2026