Spain

Vodafone España, SAU

120,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-02-12.

Rank · Sector

#105

of 369 in Media, Telecoms and Broadcasting

Rank · Spain

#91

of 1,075

Rank · All fines

#434

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-02-12
Controller / Processor: Vodafone España, SAU
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA (AEPD) imposed a fine of EUR 200,000 on Vodafone España, S.A.U. A former customer had received e-mails containing electronic bills even after he had terminated his contract with the controller resulting in a processing of personal data without sufficient legal basis. The data subject states that he still receives e-mails from the controller, although he has already objected to this several times and the controller has already received a fine twice for exactly these facts. The fine imposed this time is this high because the infringement was classified as very serious by the Spanish DPA. Among other things, because this was already the third violation in this matter. The original fine of EUR 200,000 was reduced for both immediate payment and admission of responsibility to EUR 120,000.

Open original source Links to the regulator's original publication or another source.