Enforcing jurisdiction
Spain · Geography does not establish applicable law.
Confirmed applicable legislation
No confirmed legal basis recorded.
Privacy topics

Vodafone España, S.A.U. – €30,000 Fine (Spain, 2019)

€30,000Agencia Española de Protección de Datos1 January 2019Spain
reduced
Fine

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

Vodafone España accidentally sent a customer's personal purchase history to another customer via SMS. This incident is crucial because it shows the importance of protecting customer information.

What happened

Vodafone disclosed a customer's purchase history through an SMS sent to another customer.

Who was affected

The customer whose purchase history was improperly shared with another individual.

What the authority found

The authority ruled that Vodafone failed to protect customer data adequately, violating GDPR principles.

Why this matters

This ruling underscores the need for companies to implement strong data protection measures. Businesses should review their data handling practices to prevent unauthorized disclosures.

Recorded legal citations
Automatically processed
Art. 32 GDPR
Art. 5(1)(f) GDPR
View original scraped data
Art. 5(1) f) GDPR
Art. 32(GDPR)

Original imported citations before automated processing; the processing history does not establish independent verification.

Source checks

Secondary-source text retrieved.

Automated check recorded — 13 March 2026.

No issues were reported by that automated check.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Spain enforcementAgencia Española de Protección de Datos actionsAll Vodafone España, S.A.U. actions
Full Legal Summary
Detailed

Disclosure of customer personal data (i.a. purchase history) via an SMS to another customer. The initial fine of EUR 50.000 was reduced to EUR 30.000.

Related Enforcement Actions (5)

Other enforcement actions involving Vodafone España, S.A.U. in ES

Current
Jan 2019

Fine

€30K

Fine
Feb 2020· Agencia Española de Protección de Datos

The complainant had access to third party data in his personal Vodafone profile.

€42K
Fine
Mar 2020· Agencia Española de Protección de Datos

According to the AEPD, the company had not been able to demonstrate adequate measures to ensure information security, leading to unauthorized access t...

€42K
Fine
Oct 2021· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A woman filed a complaint against the controller based on the fact that the controller ...

€40K
Fine
Oct 2022· Agencia Española de Protección de Datos

The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA for having unsuccessfully requested a copy ...

€56K
Fine
Mar 2023· Agencia Española de Protección de Datos

The Spanish DPA (AEPD) has imposed a fine on Vodafone España, S.A.U. A data subject had filed a complaint against the data controller as unauthorized ...

€136K

Details

Fine Date

1 January 2019

Authority

Agencia Española de Protección de Datos

Fine Amount

€30,000

Sources

About this data

Data: CMS GDPR Enforcement Tracker
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Vodafone España, S.A.U. - Spain (2019). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: