- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
ORANGE ESPAGNE S.A.U. – €100,000 Fine (Spain, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
ORANGE ESPAGNE S.A.U. was fined EUR 100,000 for requiring customers to have their ID photographed for cell phone deliveries. Although this was meant to prevent fraud, the authority found it was too intrusive and violated privacy rules. This case serves as a reminder for companies to consider less invasive methods for security.
What happened
ORANGE required customers to have their ID photographed as a condition for cell phone delivery.
Who was affected
Customers who purchased cell phones from ORANGE and were subjected to ID photography.
What the authority found
The authority ruled that ORANGE's method of processing personal data was excessive and violated GDPR privacy principles.
Why this matters
This ruling shows that companies must find a balance between security and privacy. Businesses should explore alternative methods that are less intrusive when verifying customer identities.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 10 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has imposed a fine of EUR 100,000 on ORANGE ESPAGNE S.A.U.. A customer who had purchased a cell phone from ORANGE had filed a complaint with the DPA. As a condition to deliver the cell phone, ORANGE stated that the delivery person had to take a photo of the front and back of the customer's ID card. ORANGE implemented these measures for security purposes to prevent fraud and identity theft. Despite these legitimate purposes, the DPA found that there existed far less intrusive means to the data subject´s privacy of preserving these purposes than photographing the ID card and thereby processing a variety of personal data.
Related Enforcement Actions (2)
Other enforcement actions involving ORANGE ESPAGNE S.A.U. in ES
Fine
€100K
Details
Fine Date
16 March 2023
Authority
Agencia Española de Protección de Datos
Fine Amount
€100,000
About this data
Cite as: Cookie Fines. ORANGE ESPAGNE S.A.U. - Spain (2023). Retrieved from cookiefines.eu
Last updated: