BULLETIN №082Last updated · 29 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 13 Jan 2022 | IBERDROLA CLIENTES, S.A.U.IBERDROLA CLIENTES, S.A.U. was fined EUR 70,000 by the AEPD for changing an electricity supply contract without the customer's knowledge or consent. The authority found that this conduct breached data protection rules. | ES | AEPD | GDPR | €70,000 | ↗ |
| 15 Apr 2025 | LVMH IBERIA, S.L.LVMH IBERIA, S.L. was fined by the AEPD 70,000 EUR for adding an employee’s personal phone number to a WhatsApp group without consent. The authority treated this as a breach of data protection rules. | ES | AEPD | GDPR | €70,000 | ↗ |
| 08 Jul 2022 | Anonymizováno (ÚOOÚ UOOU-03988/20-54)The entity was fined for processing personal data without a legal basis. The infringement involved sending unsolicited offers using data obtained from the business register. | CZ | UOOU | GDPR | €2,844 | ↗ |
| 31 May 2018 | Iqbal QasimIqbal Qasim was fined by the Garante in the amount of EUR 70,000 for registering phone SIM cards to third parties without their consent. The conduct breached privacy and personal data protection rules. | IT | Garante | GDPR | €70,000 | ↗ |
| 01 Jan 2023 | TELEFÓNICA MÓVILES ESPAÑA, S.A.TELEFÓNICA MÓVILES ESPAÑA, S.A. was fined by the AEPD 70,000 EUR for changing the ownership of a mobile line without proper verification. The failure enabled unauthorized access to the complainant’s bank data and fraudulent transactions. | ES | AEPD | GDPR | €70,000 | ↗ |
| 18 Feb 2020 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 70,000 EUR by the AEPD for incorrectly linking a customer's phone lines to another person's details. The case concerned a breach of data protection rules and indicated deficiencies in personal data processing. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2023 | Suministrador Ibérico de Energía, S.L.Suministrador Ibérico de Energía, S.L. was fined by the AEPD €70,000 for switching a customer's electricity provider without consent. The authority found that the processing lacked a valid legal basis under Article 6(1) GDPR. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2020 | Telefónica Móviles España, S.A.U.Telefónica Móviles España, S.A.U. was fined EUR 70,000 by the AEPD for unauthorized charges on a customer's account. The authority found a breach of Article 6(1) GDPR, indicating processing without a valid legal basis. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2019 | Xfera Móviles, S.A.Xfera Móviles, S.A. was fined by the AEPD 70,000 EUR for the unauthorized disclosure of personal data caused by an error. The authority found a breach of the GDPR principle of integrity and confidentiality. | ES | AEPD | GDPR | €70,000 | ↗ |
| 07 Mar 2022 | DIGI SPAIN TELECOM, S.L.DIGI SPAIN TELECOM, S.L. was fined by the AEPD 70,000 EUR for issuing a duplicate SIM card to a third party without proper identity verification. The incident enabled unauthorized access to a bank account and resulted in financial loss. | ES | AEPD | GDPR | €70,000 | ↗ |
| 04 May 2022 | DIGI SPAIN TELECOM, S.L.DIGI SPAIN TELECOM, S.L. was fined by the AEPD 70,000 EUR for issuing a SIM card duplicate without verifying the requester’s identity. The failure enabled unauthorized access to a bank account and caused financial loss to the complainant. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2022 | VODAFONE ONO, S.A.U.VODAFONE ONO, S.A.U. was fined by the AEPD 70,000 EUR for unlawfully accessing a creditworthiness file. The company used an individual's tax ID without legitimate grounds, breaching data protection rules. | ES | AEPD | GDPR | €70,000 | ↗ |
| 15 Jul 2022 | BANCO BILBAO VIZCAYA ARGENTARIA, S.A.The bank was fined for requesting a disproportionate amount of personal data, including a copy of the DNI, to process a request for information about account movements. The authority found this to be a breach of the data minimization principle. | ES | AEPD | GDPR | €70,000 | ↗ |
| 08 Feb 2023 | VODAFONE SERVICIOS, S.L.U.VODAFONE SERVICIOS, S.L.U. was fined by the AEPD 70,000 EUR for a SIM card duplication incident. The incident resulted in identity theft and unauthorized access to a bank account, indicating a breach of data protection rules. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2021 | ORANGE ESPAÑA VIRTUAL, S.L.SIMYO was fined for failing to adequately protect personal data, which enabled unauthorized SIM card duplication. The incident led to fraudulent bank transactions and indicates significant security shortcomings. | ES | AEPD | GDPR | €70,000 | ↗ |
| 02 Feb 2023 | DIGI SPAIN TELECOM, S.L.DIGI SPAIN TELECOM, S.L. was fined by the AEPD 70,000 EUR for issuing a duplicate SIM card without the complainant's consent. The incident led to attempts to gain unauthorized access to the complainant's bank accounts. | ES | AEPD | GDPR | €70,000 | ↗ |
| 03 Aug 2022 | Telefónica Móviles España, S.A.U.Telefónica Móviles España, S.A.U. was fined EUR 70,000 by the AEPD for providing a SIM card duplicate to a third party without the data subject’s consent. The authority found this conduct to be a breach of Article 6(1) GDPR. | ES | AEPD | GDPR | €70,000 | ↗ |
| 04 Jul 2021 | VODAFONE ESPAÑA, S.A.U.The AEPD fined VODAFONE ESPAÑA, S.A.U. EUR 70,000 for allowing a third party to contract phone numbers using another individual's identity. The case concerns a breach of data protection rules and inadequate identity verification. | ES | AEPD | GDPR | €70,000 | ↗ |
| 16 Nov 2023 | Intelling LtdBetween 1 January 2021 and 11 November 2021, Intelling sent 1,164,877 direct marketing messages in breach of Regulation 22 of PECR. The Commissioner opened the case after receiving 1,103 complaints via the 7726 Spam Reporting Service. | GB | ICO | ePrivacy | €79,982 | ↗ |
| 01 Jan 2023 | ENERGÍA COLECTIVA, S.L.ENERGÍA COLECTIVA, S.L. was fined by the AEPD for inaccurately processing personal data. The issue led to incorrect billing and an intrusion into individuals’ privacy. | ES | AEPD | GDPR | €70,000 | ↗ |