[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f898KmmO-lzJJIV2p3XUhTval3JtOEqZG9mPS49h7qpw":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"10c9949b-8bcd-4d18-bf44-b21198927795","AEPD (Spain) - EXP202406239","aepd-spain-exp202406239-32448c","Holding: removed faulty reference ← Older revision Revision as of 07:29, 16 September 2026 Line 83: Line 83: }} }} The DPA rejected an energy company's internal appeal and upheld a €1,000,000 fine under [[Article 32 GDPR|Article 32 GDPR]], holding that a call centre identity verification protocol based on static, easily accessible customer data was inadequate. The DPA rejected an energy company's internal appeal and upheld a €1,000,000 fine under [[Article 32 GDPR]], holding that a call centre identity verification protocol based on static, easily accessible customer data was inadequate. == English Summary == == English Summary == Line 99: Line 99: The DPA rejected all grounds of appeal and confirmed the fine of €1,000,000 and the corrective order. The DPA rejected all grounds of appeal and confirmed the fine of €1,000,000 and the corrective order. First, on the alleged violation of the right to be heard, the DPA held that no submissions to the proposed resolution had ever been received, neither around the date claimed by the controller (14 November 2025) nor under the registry number it cited, and that the controller had not even attached the alleged proof of filing to its appeal. Since the controller had been able to make submissions at every stage of the procedure, no violation of its right of defence had occurred. The DPA also recalled, under [[Article 118 GDPR]] Article 118 LPACAP, that facts and documents which a party could have submitted during the hearing phase but did not cannot be taken into account when deciding an appeal. First, on the alleged violation of the right to be heard, the DPA held that no submissions to the proposed resolution had ever been received, neither around the date claimed by the controller (14 November 2025) nor under the registry number it cited, and that the controller had not even attached the alleged proof of filing to its appeal. Since the controller had been able to make submissions at every stage of the procedure, no violation of its right of defence had occurred. The DPA also recalled, under Article 118 LPACAP, that facts and documents which a party could have submitted during the hearing phase but did not cannot be taken into account when deciding an appeal. Second, on the presumption of innocence, the DPA held that the sanctioning resolution had established, on the basis of the documents in the file, that the verification protocol did not meet the requirements of [[Article 32 GDPR]]. The guide listed nine categories of data but did not specify which four an agent had to request in each case or according to which criteria. The data used were static and, in many cases, easily accessible to third parties, and allowing verification with any 4 of 9 categories widened the combinations an unauthorised third party could know or deduce. The DPA held that this did not amount to multi-factor verification, since the system combined only personal data of the holder without any additional authentication factor such as passwords or one-time codes. It also held that the guide itself allowed agents to update a customer's telephone number or e-mail address when these appeared spontaneously during a conversation, without asking for the customer's confirmation, which could compromise future authentication and the accuracy of the database. Finally, the lack of any record of which data were requested and provided during verification made it impossible to reconstruct the process in case of an incident or audit, contrary to [[Article 32 GDPR#1b|Article 32(1)(b) GDPR]] and the accountability duty in [[Article 24 GDPR]]. Second, on the presumption of innocence, the DPA held that the sanctioning resolution had established, on the basis of the documents in the file, that the verification protocol did not meet the requirements of [[Article 32 GDPR]]. The guide listed nine categories of data but did not specify which four an agent had to request in each case or according to which criteria. The data used were static and, in many cases, easily accessible to third parties, and allowing verification with any 4 of 9 categories widened the combinations an unauthorised third party could know or deduce. The DPA held that this did not amount to multi-factor verification, since the system combined only personal data of the holder without any additional authentication factor such as passwords or one-time codes. It also held that the guide itself allowed agents to update a customer's telephone number or e-mail address when these appeared spontaneously during a conversation, without asking for the customer's confirmation, which could compromise future authentication and the accuracy of the database. Finally, the lack of any record of which data were requested and provided during verification made it impossible to reconstruct the process in case of an incident or audit, contrary to [[Article 32 GDPR#1b|Article 32(1)(b) GDPR]] and the accountability duty in [[Article 24 GDPR]]. Third, on strict liability, the DPA held that the infringement had been committed at least negligently. Citing the CJEU judgment of 5 December 2023, C‑807\u002F21 (Deutsche Wohnen), and Spanish case law, it noted that a controller can be fined under [[Article 83 GDPR]] when it could not have been unaware of the infringing nature of its conduct. Although [[Article 32 GDPR|Article 32 GDPR]] imposes an obligation of means rather than of result, an entity of the controller's size could not be considered to have adopted measures adequate to the risk when its verification, traceability and database update procedures showed clear deficiencies. Third, on strict liability, the DPA held that the infringement had been committed at least negligently. Citing the CJEU judgment of 5 December 2023, C‑807\u002F21 (Deutsche Wohnen), and Spanish case law, it noted that a controller can be fined under [[Article 83 GDPR]] when it could not have been unaware of the infringing nature of its conduct. Although [[Article 32 GDPR]] imposes an obligation of means rather than of result, an entity of the controller's size could not be considered to have adopted measures adequate to the risk when its verification, traceability and database update procedures showed clear deficiencies. Fourth, on proportionality, the DPA held that the fine was calculated under the GDPR's own system, which applies as lex specialis over the general rules of administrative law. Starting from a turnover of €11,353,755,000, the maximum fine under [[Article 83 GDPR#4|Article 83(4) GDPR]] was €227,075,100. To set the level of seriousness under [[Article 83 GDPR#2|Article 83(2) GDPR]] and the EDPB Guidelines 04\u002F2022 on the calculation of administrative fines, the DPA considered that all of the controller's customers were potentially affected (contextualised with the figure of 7,146,778 supply points), that the infringement lasted more than 18 months, and that the data at stake, including DNI and bank account numbers, qualified as sensitive within the meaning of the Guidelines even though they were not special categories under [[Article 9 GDPR]]. Negligence was assessed as neutral. As aggravating factors, the DPA applied [[Article 83 GDPR#2e|Article 83(2)(e) GDPR]], given a previous infringement in PS\u002F00398\u002F2021, and Article 76(2)(b) LOPDGDD in relation to [[Article 83 GDPR#2k|Article 83(2)(k) GDPR]]. It rejected the comparison with the €500,000 fine in EXP202500113, since that bank had a turnover more than ten times lower, an infringement lasting less than six months and no prior sanctions. Fourth, on proportionality, the DPA held that the fine was calculated under the GDPR's own system, which applies as lex specialis over the general rules of administrative law. Starting from a turnover of €11,353,755,000, the maximum fine under [[Article 83 GDPR#4|Article 83(4) GDPR]] was €227,075,100. To set the level of seriousness under [[Article 83 GDPR#2|Article 83(2) GDPR]] and the EDPB Guidelines 04\u002F2022 on the calculation of administrative fines, the DPA considered that all of the controller's customers were potentially affected (contextualised with the figure of 7,146,778 supply points), that the infringement lasted more than 18 months, and that the data at stake, including DNI and bank account numbers, qualified as sensitive within the meaning of the Guidelines even though they were not special categories under [[Article 9 GDPR]]. Negligence was assessed as neutral. As aggravating factors, the DPA applied [[Article 83 GDPR#2e|Article 83(2)(e) GDPR]], given a previous infringement in PS\u002F00398\u002F2021, and Article 76(2)(b) LOPDGDD in relation to [[Article 83 GDPR#2k|Article 83(2)(k) GDPR]]. It rejected the comparison with the €500,000 fine in EXP202500113, since that bank had a turnover more than ten times lower, an infringement lasting less than six months and no prior sanctions. Line 112: Line 112: == Comment == == Comment == The decision confirms the AEPD's position that knowledge-based identity verification relying on static customer data does not satisfy [[Article 32 GDPR|Article 32 GDPR]] for a large energy retailer, and that the absence of any log of the verification steps is itself a security failure because it prevents the controller from demonstrating compliance. The DPA's reading of \"sensitive data\" for fine calculation purposes is also worth noting: following the EDPB Guidelines 04\u002F2022, it treats national ID and bank account numbers as sensitive even though they fall outside Articles 9 and 10 GDPR. The reasoning on the missing submissions is striking, as the entire nullity ground rested on a filing of which the DPA found no trace and which the controller did not document in its appeal either. The decision exhausts the administrative procedure; the controller may still challenge it before the Spanish National Court (Audiencia Nacional). The decision confirms the AEPD's position that knowledge-based identity verification relying on static customer data does not satisfy [[Article 32 GDPR]] for a large energy retailer, and that the absence of any log of the verification steps is itself a security failure because it prevents the controller from demonstrating compliance. The DPA's reading of \"sensitive data\" for fine calculation purposes is also worth noting: following the EDPB Guidelines 04\u002F2022, it treats national ID and bank account numbers as sensitive even though they fall outside Articles 9 and 10 GDPR. The reasoning on the missing submissions is striking, as the entire nullity ground rested on a filing of which the DPA found no trace and which the controller did not document in its appeal either. The decision exhausts the administrative procedure; the controller may still challenge it before the Spanish National Court (Audiencia Nacional). == Further Resources == == Further Resources ==","Spain's Data Protection Agency (AEPD) has rejected an energy company's appeal and confirmed a €1,000,000 fine for inadequate identity verification protocols. The AEPD found that the call center's method, relying on static and easily accessible customer data without multi-factor authentication, violated GDPR Article 32. The agency also noted the lack of audit trails for verification processes as a failure to demonstrate compliance.","Spain's AEPD upholds €1M GDPR fine against an energy company for inadequate call center identity verification.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_EXP202406239&diff=53070&oldid=52120","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-16T07:29:58+00:00","2026-09-16T08:00:14.726099+00:00",7,[17,20],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,40],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":130},[49,78,101],{"slug":50,"name":51,"problem":52,"products":53},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":79,"name":80,"problem":81,"products":82},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[83,88,96],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":84,"product_name":85,"url":86,"description":87},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":97,"product_name":98,"url":99,"description":100},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":102,"name":103,"problem":104,"products":105},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-onum","Falcon Onum","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-siem\u002Ffalcon-onum\u002F","Real-time telemetry pipeline from CrowdStrike's purchase of Onum. It filters and streams data into Falcon Next-Gen SIEM and can run detections on third-party data before it is stored.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"axoflow","Axoflow","\u002Fvendor-logos\u002Faxoflow.png","axolake","AxoLake","https:\u002F\u002Faxoflow.com\u002Faxolake-petabyte-security-data-storage","Data lake for security data in Parquet format, searchable in place without rehydration.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-pipelines","Abstract Pipelines","https:\u002F\u002Fwww.abstract.security\u002Fplatform\u002Fcollection","Collects security data from any source, normalises it in the pipeline and routes it to several destinations.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":146},"1m-gdpr-fine-for-weak-call-center-identity-verification","€1M GDPR Fine for Weak Call Center Identity Verification","Spain's AEPD imposed a €1,000,000 fine on an energy company after finding that its call center relied solely on static, easily obtainable customer data (such as name, address, or account number) to verify caller identity — with no multi-factor authentication in place. This approach violates GDPR Article 32, which requires organisations to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Critically, the absence of audit trails meant the company could not demonstrate compliance, compounding the regulatory breach. This case highlights that identity verification over voice channels is a significant attack vector and must be treated with the same rigour as digital authentication systems.",[136,137,138,139,140,141,142,143,144,145],"GDPR Article 32 – Security of processing","GDPR Article 5(1)(f) – Integrity and confidentiality principle","NIST SP 800-63B – Digital Identity Guidelines (Authenticator Assurance Levels)","NIST AC-17 – Remote Access","NIST IA-2 – Identification and Authentication","NIST AU-2 – Audit Events","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","ISO\u002FIEC 27001:2022 – A.8.5 Secure authentication","ITIL Service Management – Information Security Management (audit and compliance)",{}]