Xfera Móviles S.A. – €150,000 Fine (Spain, 2021)

First, a data subject filed a complaint in which indicated that they have exercised their right to object to the use of their personal data for direct marketing purposes but the defendant continued to send SMS to their mobile number. The complainant provided proof of having received more than 60 SMS within 30 days which suggests that the defendant did not fulfil the complainant’s request. Second, the same complainant indicated that they reported to the defendant that they were receiving a large number of SMS to their mobile number with confidential information about third parties. The defendant told the complainant that it had noted the incident and that it would not reoccur. However, the defendant continued to send information related to third parties to the complainant, in particular, a security code to access the platform "Mi Yoigo", to which the complainant accessed and was able to view personal data from a third party. The access given allowed the complainant to view someone else’s bills, phone number, address, bank account, account number and the possibility to make any changes in the third party’s profile. The complainant also provided proof to this effect.