€ 15,000 fine for a personal data breach

The case concerned a customer of the Spanish telecoms operator Telefónica de España, S.A.U. After receiving advertisements without his consent, the customer tried several times, unsuccessfully, to opt out of receiving such communications. He then filed his objection to direct marketing with the operator. However, he continued to receive advertising messages after sending the request. The Spanish supervisory authority (AEPD) found that the company violated Article 21(1) of the Organic Law on Data Protection and Guarantee of Digital Rights because it continued to send direct marketing messages to the data subject without his consent. The AEPD considered the intentional nature and lack of diligence of the company’s actions as an aggravating circumstance, and the nature and amount of damage caused as a mitigating circumstance.

source

LATEST POSTS

FIND US