Enforcing jurisdiction
Spain · Geography does not establish applicable law.
Confirmed applicable legislation

Xfera Moviles S.A. – €60,000 Fine (Spain, 2020)

€60,000Agencia Española de Protección de Datos3 February 2020Spain
final
Fine

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

Xfera Moviles S.A. was fined for processing personal data without proper consent. This included sensitive information like bank details and customer addresses. This case highlights the importance of obtaining user consent before handling personal information.

What happened

Xfera Moviles unlawfully processed personal data, including bank details and customer addresses.

Who was affected

Customers whose personal data was processed without their consent by Xfera Moviles.

What the authority found

The Spanish data protection authority found that Xfera Moviles violated GDPR by not having a valid legal basis for processing personal data.

Why this matters

This ruling emphasizes the need for companies to ensure they have proper consent before processing personal data. Small businesses should review their data handling practices to comply with GDPR.

Recorded legal citations
Automatically processed
Art. 5 GDPR
Art. 6 GDPR
View original scraped data
Art. 5(GDPR)
Art. 6(GDPR)

Original imported citations before automated processing; the processing history does not establish independent verification.

Source checks

Linked-source text retrieved.

Automated check recorded — 12 March 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Spain enforcementAgencia Española de Protección de Datos actionsAll Xfera Moviles S.A. actions
Full Legal Summary
Detailed

According to the data protection authority, XFERA MOVILES has violated Article 6(1) of the GDPR, as the company has unlawfully processed data, including bank details, customer address and name of the data subjects.

Related Enforcement Actions (6)

Other enforcement actions involving Xfera Moviles S.A. in ES

Fine
Oct 2019· Agencia Española de Protección de Datos

Xfera Movile has used personal data without a legal basis for the conclusion of a telephone contract and has continued to process personal data even w...

€60K
Current
Feb 2020

Fine

€60K

Fine
Jun 2020· Agencia Española de Protección de Datos

A customer claimed to have received an SMS from Xfera Móviles informing about the non-payment and the resulting suspension of the service in relation ...

€39K
Fine
Jun 2020· Agencia Española de Protección de Datos

The data subject received a notice from a debt collection company demanding payments in connection with Xfera Móviles' services, even though the claim...

€75K
Fine
Jul 2020· Agencia Española de Protección de Datos

A data subject had received a call from another Xfera Móviles customer who stated that the company had charged his bank account with an invoice, discl...

€70K
Fine
Sept 2020· Agencia Española de Protección de Datos

Failure to remove the data subject's personal data at the time of cancellation of his/her telephone services contract and sending a warning to the dat...

€60K
Fine
Dec 2020· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) imposed a fine on Xfera Móviles, S.A. due to insufficient legal basis for data processing. The data subject states that two tel...

€40K

Details

Fine Date

3 February 2020

Authority

Agencia Española de Protección de Datos

Fine Amount

€60,000

Sources

About this data

Data: CMS GDPR Enforcement Tracker
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Xfera Moviles S.A. - Spain (2020). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: