Spain

Vodafone España, S.A.U.

40,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2021-10-19.

Rank · Sector

#220

of 369 in Media, Telecoms and Broadcasting

Rank · Spain

#270

of 1,075

Rank · All fines

#804

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2021-10-19
Controller / Processor: Vodafone España, S.A.U.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA (AEPD) has fined Vodafone España, S.A.U. EUR 40,000. An individual had filed a complaint with the DPA against Vodafone for debiting his bank account in May 2020 for a Vodafone telephone line whose owner was not him but his ex-partner.
As it turned out, the complainant's ex-partner had concluded a contract with Vodafone in his name. She stated that she was authorized to do so, but did not provide any proof of this. The DPA found that Vodafone had unlawfully processed the complainant's data. Indeed, compliance with the principle of lawfulness in the processing of third party data requires that the controller is able to prove lawfulness.

Open original source Links to the regulator's original publication or another source.