Enforcing jurisdiction
Spain · Geography does not establish applicable law.
Confirmed applicable legislation

Vodafone España, S.A.U. – €60,000 Fine (Spain, 2020)

€60,000Agencia Española de Protección de Datos4 March 2020Spain
final
Fine

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

Vodafone España was fined after a customer received messages about a new contract that they did not authorize. An employee activated a contract with a third operator using the customer's information without consent. This case highlights the need for companies to verify consent before processing personal data.

What happened

Vodafone España activated a contract with a third operator on behalf of a customer without their consent.

Who was affected

The customer who received SMS notifications about a contract they did not authorize.

What the authority found

The Spanish data protection authority found that Vodafone could not prove it had consent to process the customer's personal data.

Why this matters

This case illustrates the importance of obtaining clear consent before processing personal data, which is vital for all businesses.

Recorded legal citations
Automatically processed
Art. 5 GDPR
Art. 6 GDPR
View original scraped data
Art. 5(GDPR)
Art. 6(GDPR)

Original imported citations before automated processing; the processing history does not establish independent verification.

Source checks

Linked-source text retrieved.

Automated check recorded — 12 March 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

According to the AEPD, the data subject has received several SMS from a separate operator indicating the activation of a new contract. The reason for this was that an employee of Vodafone España activated a contract with a third operator on behalf of the data subject. Vodafone could not demonstrate consent or sufficient legitimate interests for this processing of personal data.

Related Enforcement Actions (20)

Other enforcement actions involving Vodafone España, S.A.U. in ES

Current
Mar 2020

Fine

€60K

Details

Fine Date

4 March 2020

Authority

Agencia Española de Protección de Datos

Fine Amount

€60,000

About this data

Data: CMS GDPR Enforcement Tracker
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Vodafone España, S.A.U. - Spain (2020). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: