AEPD (Spain) - EXP202406239

Spain's AEPD imposed a €1,000,000 fine on an energy company after finding that its call center relied solely on static, easily obtainable customer data (such as name, address, or account number) to verify caller identity — with no multi-factor authentication in place. This approach violates GDPR Article 32, which requires organisations to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Critically, the absence of audit trails meant the company could not demonstrate compliance, compounding the regulatory breach. This case highlights that identity verification over voice channels is a significant attack vector and must be treated with the same rigour as digital authentication systems.