Spain

Vodafone España, S.A.U.

54,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-01-04.

Rank · Sector

#186

of 369 in Media, Telecoms and Broadcasting

Rank · Spain

#215

of 1,075

Rank · All fines

#680

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-01-04
Controller / Processor: Vodafone España, S.A.U.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) d), f) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The data subject had concluded a contract with the controller (Vodafone España, S.A.U.). However, the products provided under this contract were not delivered in the name of the data subject, but in the name of a third party. Subsequently, the data subject contacted the company's data protection officer by e-mail in order to restore the accuracy of his/her data stored at Vodafone. However, no response was received to this request. When the data subject finally contacted the telecommunications company by telephone, he/she was addressed by the name of the third party. His/her inquiry was answered with a response that did not refer to his/her inquiry, but to the inquiry of the third party. According to the telecommunications company, the incident was caused by a defect in their system due to a system migration. The Spanish DPA (AEPD) initially fined Vodafone España, S.A.U. EUR 90,000, but the original fine was reduced to EUR 54,000 due to the timely payment and admission of guilt.

Open original source Links to the regulator's original publication or another source.