Vodafone España, S.A.U. – €200,000 Fine (Spain, 2024)

On 20 September 2022, a data subject filed a complaint with the Spanish DPA (AEPD). The data subject had received numerous advertising calls from Vodafone España, S.A.U. (the controller) on various dates, from various phone numbers. This occurred despite the data subject being listed on no-call lists. The controller noted that it has partners who carry out calls on its behalf. However, it claimed that there was no record in its database associating the phone numbers that called the data subject with the controller. It noted that its calling partners are subject to contractual requirements that ensure they will not use non-Vodafone phone numbers, and that the controller has stopped working with partners that failed to comply with contractual obligations including data protection standards. The AEPD dismissed the complaint in part because some calls could not be tied to the controller (see [https://www.aepd.es/documento/ai-00421-2022.pdf EXP202210932]). However, it requested further information from the controller with regard to certain calls from third parties made by Vodafone partners on behalf of the controller. However, the controller failed to respond or to provide the AEPD with the requested information. On 19 September 2023, the AEPD initiated sanctioning procedures against the controller for a presumed infraction of Article 58(1) GDPR. In October 2023, the controller affirmed that it had not provided the requested documents or facilitated the investigation. Nonetheless, it argued that it had collaborated with the AEPD at all times and had no intention of hindering the investigation. It claimed that it could not provide the requested information without proper judicial authorisation and without breaching data protection obligations. It also argued that the calls were not affiliated with Vodafone but instead with a new customer of the former partner, which Vodafone had ended its contract with. Finally, it claimed that even if it had provided the requested information, the investigation would have been unaffected because the owners of the numbers that made the calls did not respond to the AEPD’s requests. The controller also pointed out that documents and investigations carried out in this case against third parties were not provided to the controller and requested full access. The AEPD refused to provide access on the basis that those proceedings were independent of the current one, and that the investigation of third parties is unrelated to the sanctioning proceeding. The AEPD found that the controller had failed to provide the AEPD with the information it requested, thus hindering the AEPD’s duty of investigation and infringing Article 58(1) GDPR. The AEPD imposed a fine of €200,000.