The Spanish Data Protection Agency has imposed a fine of 48,000 euros on a contact center company that provided services for a client managed from China, after verifying the improper use of its employees' personal phones to receive work access credentials.
Collection of personal data without a proven legal basis
The investigation began after a complaint related to the request for telephone numbers and dates of birth from workers during an internal training. This data was collected on a blank sheet of paper, without providing information about the processing or establishing a valid legal basis. Of the 364 active employees, 203 provided their personal mobile number to receive authentication tokens via SMS.
The company alleged that this practice was necessary to execute the employment contract and that the use of personal mobile phones was a provisional solution. However, the AEPD has determined that there was no valid legal basis for processing and communicating personal telephone numbers for employment authentication purposes, according to Article 6 of the GDPR.
Internal warnings and less intrusive alternatives
The company's Data Protection Officer had expressly warned about the illegality of using personal phones for this purpose, but the organization continued with the practice. The ruling emphasizes that the execution of the contract does not justify the transfer of personal phone numbers to a third party, especially when less intrusive alternatives exist, such as the use of corporate means.
"Essential is not the same as comfortable, fast, or cheap" - Resolution of the AEPD
The Agency also recalls that in the workplace, the consent of workers is not usually considered free if there is no real alternative for the processing of their personal data.
Resolution and economic sanction
The resolution (PS-00456/2025) concludes that the company violated the principle of lawfulness in the processing of personal data. The initial fine of 80,000 euros has finally been reduced to 48,000 euros for acknowledgment of responsibility and voluntary payment.