Spain

Vodafone España, S.A.U.

96,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-08-03.

Rank · Sector

#112

of 369 in Media, Telecoms and Broadcasting

Rank · Spain

#108

of 1,075

Rank · All fines

#496

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-08-03
Controller / Processor: Vodafone España, S.A.U.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 6 (1) GDPR, Art. 17 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA (AEPD) has imposed a fine on Vodafone España, S.A.U.. A data subject had filed a complaint with the DPA against the controller for failing to comply with her deletion request. The data subject states that on she had received calls from the company ISGF on behalf of the controller claiming a debt received from a third party for an ADSL connection for the residence of the data subject. However, the data subject had never entered into a contract for an ADSL connection. Instead, the contract had been concluded by a third party who had fraudulently used the name and ID number of the data subject to conclude the contract in her name. The data subject then requested ISGF to cancel the contract and asked the controller to delete her personal data. However, the controller had not responded to her request. The DPA then imposed a fine of EUR 120,000 which consisted of EUR 70,000 due to a violation of Art. 6 (1) GDPR and EUR 50,000 due to a violation of Art. 17 (1) GDPR. The original fine was reduced to EUR 96,000 due to voluntary payment.

Open original source Links to the regulator's original publication or another source.