The Spanish data protection authority (AEPD) sanctioned a telecommunications operator for wrongly associating a customer's national identification number with a third party's data. The authority found the operator negligent, aggravated by the nearly two-year delay in rectifying the inaccurate data.

Facts and context

The Spanish data protection authority (AEPD) today published a sanction decision against XFERA MÓVILES, S.A.U. (including the imposition of an €8,000 fine) for breaches related to the data accuracy principle.

The case originated from a complaint by a customer who received, on 24 July 2024, a contract associating her national identification number with the personal data of an unknown person.

Reasons for the decision

• Data accuracy obligation (Article 5(1)(d) of the GDPR): The authority found that the complainant's national identification number had been incorrectly linked to a third party's data, leading to the sending of an erroneous contract. The operator only corrected this inaccuracy on 10 February 2026, nearly two years after the incident was reported. The AEPD considered that the lack of sufficient technical and organizational measures to prevent such errors, as well as the considerable delay in correction, constituted serious negligence, violating the accuracy principle. The sensitivity of the identification number, which allows unique identification and exposes to identity theft risks, was an aggravating factor considered by the authority.

Authority's decision

Consequently, the authority imposed an €8,000 fine on XFERA MÓVILES, S.A.U.

It is noted that the company benefited from a 20% reduction, bringing the final amount paid to €6,400, after acknowledging its responsibility and waiving all administrative appeals.

Lessons learned

This decision confirms that:

• Responsiveness in correcting inaccurate data is a key element in assessing a controller's diligence; excessive delay can turn a simple incident into serious negligence.
• Unique national identifiers must be subject to enhanced protection measures, as their inaccuracy or disclosure exposes data subjects to high risks, notably identity theft.
• Even for breaches affecting a small number of individuals, negligence and the duration of the infringement are significant aggravating factors, although the final sanction may be adjusted based on the limited scope of the incident.