- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Vodafone España, S.A.U. – €56,000 Fine (Spain, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Vodafone España was fined for not having a proper legal basis to process a customer's data. A third party accessed a customer's account and made unauthorized purchases. This case highlights the need for companies to verify the legitimacy of data processing activities.
What happened
The Spanish DPA fined Vodafone for insufficient legal basis in processing a customer's data after unauthorized access occurred.
Who was affected
A Vodafone customer whose account was accessed by unauthorized third parties was affected.
What the authority found
The DPA found that Vodafone did not adequately verify the legality of the contracts made in the customer's name.
Why this matters
This fine serves as a reminder for companies to ensure they have a valid legal basis for processing personal data. It highlights the risks of inadequate data protection practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 12 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that, unauthorized third parties had gained access to her Vodafone account and had concluded a new contract in their name, as well as purchased an iPhone 12. The DPA notes that the controller had not adequately verified whether the contracts had been lawfully and actually concluded by the data subject. The original fine of EUR 70,000 was reduced to EUR 56,000 due to voluntary payment.
Related Enforcement Actions (20)
Other enforcement actions involving Vodafone España, S.A.U. in ES
Fine
€56K
Details
Fine Date
6 July 2022
Authority
Agencia Española de Protección de Datos
Fine Amount
€56,000
Enforcement Tracker ID
ETid-1260
About this data
Cite as: Cookie Fines. Vodafone España, S.A.U. - Spain (2022). Retrieved from cookiefines.eu
Last updated: