BULLETIN №081Last updated · 26 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 20 Jan 2021 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 40,000 by the AEPD for failing to respond to a data access request. The case concerns non-compliance with GDPR obligations relating to data subject rights. | ES | AEPD | GDPR | €40,000 | ↗ |
| 08 Sept 2020 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined by the AEPD €40,000 for processing personal data without a legal basis. The case involved fraudulent contracts created in individuals’ names without their consent, breaching the principle of lawful processing. | ES | AEPD | GDPR | €40,000 | ↗ |
| 19 Feb 2024 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 200,000 by the AEPD for processing personal data without a legal basis. The case concerned a phone number portability carried out without the user's consent, which breached the requirement for lawful processing. | ES | AEPD | GDPR | €200,000 | ↗ |
| 27 Apr 2021 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined by the AEPD EUR 3,000 for sending commercial emails without the recipient’s consent. The authority found a breach of Article 21 of the LSSI, despite the recipient’s attempts to unsubscribe. | ES | AEPD | ePrivacy | €3,000 | ↗ |
| 05 Feb 2020 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 75,000 by the AEPD for processing personal data without a legal basis. The authority found a breach of Article 6(1) GDPR. | ES | AEPD | GDPR | €75,000 | ↗ |
| 11 Feb 2020 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 5,000 by the Spanish Data Protection Agency (AEPD) for failing to provide requested information. The conduct breached Article 58(1) of the GDPR and hindered the authority’s supervisory powers. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Jan 2019 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 60,000 by the AEPD for processing personal data without a legal basis. The authority found a breach of Article 6 GDPR, meaning the processing lacked a lawful basis. | ES | AEPD | GDPR | €60,000 | ↗ |
| 02 Apr 2020 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 52,000 by the AEPD for sending SMS messages to a complainant about another customer's unpaid bills. The authority found that this disclosure breached data protection rules. | ES | AEPD | GDPR | €52,000 | ↗ |
| 21 Jan 2019 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined by the AEPD in the amount of 2,500 EUR for sending unsolicited commercial SMS messages. The authority found that this conduct breached Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €2,500 | ↗ |
| 10 Jan 2020 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined by the AEPD EUR 30,000 for a data protection breach. A customer's data was incorrectly linked to another person, which allowed unauthorized access to personal information. | ES | AEPD | GDPR | €30,000 | ↗ |
| 10 Feb 2020 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined by the AEPD for processing personal data without valid consent. The case concerned a debt claim made against an individual for a contract they had not entered into. | ES | AEPD | GDPR | €60,000 | ↗ |
| 23 Jan 2025 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined 100,000 EUR by the AEPD for inaccuracies in data retention relating to SIM card purchasers. The authority found a breach of the GDPR data accuracy obligation. | ES | AEPD | GDPR | €100,000 | ↗ |
| 01 Jan 2019 | XFERA MÓVILES S.A.XFERA MÓVILES S.A. was fined 60,000 EUR by the AEPD for processing personal data without consent. As a result, unauthorized contracts were sent to a customer, indicating improper use of personal data. | ES | AEPD | GDPR | €60,000 | ↗ |
| 01 Jan 2019 | Xfera Móviles, S.A.Xfera Móviles, S.A. was fined by the AEPD 70,000 EUR for the unauthorized disclosure of personal data caused by an error. The authority found a breach of the GDPR principle of integrity and confidentiality. | ES | AEPD | GDPR | €70,000 | ↗ |
| 25 Nov 2024 | XFERA CONSUMER FINANCE ESTABLECIMIENTO FINANCIERO DE CRÉDITO, S.A.The AEPD fined XFERA Consumer Finance 5,000 EUR for sending a customer unsolicited advertising SMS messages. The messages were sent after the customer had asked to stop receiving such communications, indicating a breach of marketing communication rules. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 23 Sept 2014 | XD SOFTWARE, S.L.XD SOFTWARE, S.L. was fined by the AEPD in the amount of 6,000 EUR for sending unsolicited commercial emails and messages without recipient consent. The conduct breached Article 21 of the LSSI and involved marketing communications sent without prior authorization. | ES | AEPD | ePrivacy | €6,000 | ↗ |
| 30 Mar 2023 | XCOM DIGITAL LAB, S.L.XCOM DIGITAL LAB, S.L. was fined by the AEPD EUR 800 for sending unsolicited commercial emails. The company failed to comply with Article 21 of the LSSI despite repeated requests from the recipient to unsubscribe. | ES | AEPD | ePrivacy | €800 | ↗ |
| 05 Dec 2025 | XThe European Commission imposed a EUR 120 million fine on X for breaching transparency requirements under the Digital Services Act. The penalty covered deceptive verification design, an inadequate ad repository, and restricted access for researchers. | EU | European Commission | DSA | €120,000,000 | ↗ |
| 23 Dec 2021 | wyżej wymienionąAn administrative fine was imposed on an individual conducting business activity. The violation consisted of failing to provide the President of the Personal Data Protection Office with access to personal data and information necessary to perform his duties. | PL | UODO | GDPR | €983 | ↗ |
| 22 Dec 2021 | wyżej wymienionąA financial penalty was imposed on an individual conducting business activity for failing to ensure that the President of the Personal Data Protection Office had access to personal data and information necessary to perform his duties. The case concerned obstruction of the supervisory authority’s powers. | PL | UODO | GDPR | €982 | ↗ |