These are the highest GDPR fines in February 2025

The five highest GDPR fines issued in February 2025 were all imposed in Spain
Categories:

In February 2025, the Spanish data protection authority Agencia española protección datos again issued numerous fines for breaches of the Data Protection Act. GDPR issued. The five highest GDPR fines were all imposed in Spain. In February, fines for missing or inadequate security measures dominated in particular.

Reading tip: The five highest GDPR fines in January 2025

Orange España, 1,200,000 euros (Spain)

The Spanish data protection authority, Agencia española protección datos (AEPD), has filed a complaint against the mobile communications company Orange España, S.A.U. Fine in the total amount of 1.2 million euros. The reason was unlawful data processing in connection with the issuing of SIM card duplicates. A fraudulent employee of a franchise company had created a SIM card without the permission of a customer. This made it possible to commit financial fraud through so-called SIM swapping attacks. A total of 9,000 euros was stolen from the customer's accounts as a result. The authority found violations of Art. 6 and Art. 25 GDPR fixed.

Orange argued that this was a case of individual misconduct. The authority rejected this as the company had not taken sufficient protective measures. In particular, a duplicate SIM card was sent to fraudulent Third issued without verifying their identity. Orange was requested to take measures to verify the identity of SIM duplicates within six months. Orange lodged an appeal, arguing that the sanction was disproportionate. The authority rejected the appeal and confirmed the original decision.

Source: Fine imposed by the AEPD on Orange España, S.A.U.

Caja Rural de Jaén, 400,000 euros (Spain)

The Spanish data protection authority AEPD has imposed a fine on the cooperative bank Caja Rural de Jaén, Barcelona y Madrid S.C.C. for a massive data protection breach caused by a cyber attack on the online banking system. Inadequate security measures led to the unauthorized disclosure of sensitive customer data and thus violations of Art. 5 para. 1 lit. f, Art. 32 para.1 and Art. 33 GDPR.

The bank argued that its IT service provider Rural Servicios Informáticos S.L. was responsible. The authority rejected this claim, as the bank, as a Responsible persons for the Data protection is considered to be the best. The Fine was set at 500,000 euros and is intended to prevent future violations. The bank appealed and applied for a reduction or annulment of the fine. The AEPD rejected the appeal and emphasized the obligation to Data security.

After the bank had paid without acknowledging the debt, the original Fine reduced from 500,000 euros to 400,000 euros.

Source: Fine imposed by the AEPD on Caja Rural de Jaén, Barcelona y Madrid S.C.C.

Línea Directa Aseguradora, 300,000 euros (Spain)

The Spanish data protection authority AEPD has issued a Fine was imposed on the insurance company Línea Directa Aseguradora S.A.. The company had unlawfully processed customer data via its insurance intermediary Majorel SP Solutions S.A.. An employee of Majorel called without express Consent the customer's score with the DGT traffic authority. To do this, he used personal data such as the ID card number and the date of issue of the driver's license. He also entered a third-party e-mail address to obtain the access data for the query.

The company argued that the customer had impliedly consented to the query. The data protection authority disagreed and found violations of Art. 6 and Art. 28 GDPR was arrested. She then imposed a Fine in the amount of 300,000 euros. In addition, Línea Directa was obliged to take measures to comply with data protection regulations.

Source: Fine imposed by the AEPD on Línea Directa Aseguradora S.A.

Atrium Lex SFC S.L., 100,000 euros (Spain)

The Spanish data protection authority AEPD has initiated proceedings against the IT service provider Atrium Lex SFC S.L. Fine for breach of the duty to inform pursuant to Art. 13 GDPR and lack of security measures pursuant to Article 32 (1) GDPR was imposed. An investor had complained that the company had requested a copy of his identity card without informing him of the data processing. Atrium Lex claimed that this was necessary for identity verification.

The AEPD found that insufficient data protection measures had been taken. In particular, the Transmission of the copy of the ID card by email was considered unsafe. The authority imposed two fines of 50,000 euros each on the company. The sanctions are based on the insufficient information provided to those affected and the inadequate security measures. Atrium Lex was also obliged to take data protection measures within six months.

Source: AEPD fine notice against Atrium Lex

Caja Rural de Extremadura, 88,000 euros (Spain)

Due to a data breach resulting from a cyberattack on the online banking system, the Spanish data protection authority AEPD has issued a Fine against the cooperative bank Caja Rural de Extremadura S.C.C.. The security breach allowed unauthorized access to customers' personal and financial data. The AEPD found violations of Art. 5 para. 1 lit. f and Art. 32 GDPR  fixed.

Caja Rural de Extremadura lodged an appeal against the decision. Its IT service provider Rural Servicios Informáticos S.L. was responsible for the security measures. The authority rejected this as the bank was responsible for data processing. Responsible persons applies. A fine of 110,000 euros was imposed to prevent future infringements. The bank then lodged an appeal and requested a reduction or annulment of the sanction. The data protection authority rejected the appeal and emphasized the obligation to Data security.

After the bank had paid without acknowledging the debt, the original Fine reduced from 110,000 euros to 88,000 euros.

Source: Fine imposed by the AEPD on Caja Rural de Extremadura S.C.C.

Tags:
Share this post :