XFERA MÓVILES, S.A. – €70,000 Fine (Spain, 2025)

XFERA MÓVILES, S.A. (also known as Yoigo, the controller) is a telecommunications company. On 15 April 2022, a data subject presented a complaint to the DPA. The data subject received several advertising calls related to the controller’s services despite being included in an Advertising Exclusion List (the Robinson ListFor more information, see https://www.listarobinson.es/que-es). During its investigation, the DPA found no contractual relationship between the controller and the owners of the telephone lines from which the calls were made. The DPA dismissed the case on 22 July 2022 on the basis that it had not found a violation of data protection laws. The data subject filed an internal appeal in August 2022. The DPA carried out an investigation and began a sanctioning procedure for an alleged violation of the principle of data accuracy (Article 5(1)(d) GDPR) in April 2024. The DPA requested information from the controller on the holders of the phone lines that had called the data subject. After further investigation, the DPA found that the data provided by the controller was not accurate, as the ID documents did not match with information from the Tax Authority (and one of the IDs was proven to be false). The controller argued that the calls came from prepaid accounts, and therefore it did not have the responsibility to identify them. According to the controller, it only had the obligation to retain data in accordance with obligations under national data retention laws. The controller also argued that the DPA had no competence, as the case related to national data retention lawsLaw 25/2007, of October 18, on the conservation of data relating to electronic communications and public communications networks (Ley 25/2007, de 18 de octubre, de conservación de datos relativos a las comunicaciones electrónicas y a las redes públicas de comunicaciones), 251, de 19/10/2007. Available at https://www.boe.es/buscar/act.php?id=BOE-A-2007-18243&p=20140510&tn=1 and not the GDPR. Finally, the controller argued that the DPA’s sanctioning procedure based on data inaccuracy was not related to the complaint regarding unwanted advertising calls. The DPA first dismissed the arguments on competence and sanctioning procedure. In terms of competence, the DPA affirmed that the case fell under its competence despite the national data retention law. Under this law, the Secretariat of State for Telecommunications and Digital Infrastructure (SETID) is competent for the failure to maintain a prepaid phone line logbook. However, [https://www.boe.es/buscar/act.php?id=BOE-A-2007-18243&p=20140510&tn=1#a8 Article 8] specifies that the quality of data falls under the scope of Spanish data protection law, and that the DPA is the authority responsible for ensuring compliance with data protection requirements. According to the DPA, data accuracy (Article 5(1)(d) GDPR) is directly related to the quality of data. The DPA cited Supreme Court case lawSTS 5358/2024, 11 November 2024, ECLI:ES:TS:2024:5358 https://4dlegal.es/wp-content/uploads/2025/05/STS-5358-2024-11-XI-2024-Sala-3.a-TS-ROJ-1792-2024.pdf to support the broadening of the case; here, the Court acknowledges the possibility of setting fines for violations found during the DPA’s investigations. This means that the DPA is not strictly bound by the facts of the complaint. By limiting the procedure to the facts of the case, the DPA would fail to fulfill its duty. The DPA later held the controller responsible for the lack of data accuracy. Under the GDPR, the controller is liable for actions by the processor that violate the GDPR, unless the processor acts as a controller. Furthermore, the principle of accountability (Article 5(2) GDPR) places a proactive obligation on the controller to demonstrate compliance with data protection principles under Article 5(1) GDPR. The DPA analysed the contract between the controller and distributors of its products (processors) and concluded that YOIGO is a controller in accordance with CJEU case lawCJEU Case C-683/21, Nacionalinis visuomenės sveikatos centras, 5 December 2023. https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62021CJ0683 See also GDPRhub summary CJEU - C-683/21 - Nacionalinis visuomenės sveikatos centras and EDPB GuidelinesGuidelines 07/2020 on the concepts of controller and processor in the GDPR, 07 July 2021 (Version 2.1). Available https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en. The DPA noted that the controller had no measures in place to detect errors or inaccuracies in its data, including measures to ensure that ID numbers correspond to existing IDs. Therefore, the fine imposed on the controller was based on data inaccuracy and the absence of technical and organisational measures. Finally, the DPA stated that the controller could not be held accountable for the content of the calls with the data subject. However, due to the lack of data accuracy, the DPA was not able to investigate the potential violation of advertising calls without a legitimate basis. The DPA found a violation of Article 5(1)(d) GDPR, based on the inaccurate information given by the controller during its investigation. The DPA imposed a fine of €70,000, taking into account the fact that the data inaccuracy was an obstacle during its investigations, and the fact that the violation occurred within a framework of data processing activities that the controller carries out on a regular basis.