Vodafone Italy S.p.A – €12,250,601 Fine (Italy, 2020)

The Garante per la Protezione dei Dati Personali, Italy’s DPA, led an investigation into Vodafone Italy S.p.A following various complaints by Vodafone users and non-users, which highlighted multiple issues on the phone company’s practices. The first group of claimants complained about constant unwanted promotional phone calls and SMS from Vodafone, with one example being a person claiming that they have been receiving at least 4/5 messages a month by Vodafone since 2018, even after he communicated to the company that he no longer wanted to receive such messages. Vodafone blamed this last mishap on a “system error” that failed to register the client’s request to stop the promotional messages. The second set of complaints concerned the way that the company stored their client’s data. More specifically, costumers complained about being approached by Vodafone operators, usually after reporting issues with their internet service. However, it turned out that those were call-centres that worked for other phone companies or third party callers that used Vodafone’s logo in their WhatsApp profile. These unauthorized individuals would often ask about the issues the users reported, point out that Vodafone would increase their costumer service fees and offer to subscribe the user to a different phone provider. Other times, they would just request for the user’s IDs, possibly for fraudulent or phishing purposes. Vodafone claimed to have been aware of these practices in the past, confirmed that those were indeed unauthorized parties under false pretences, and explained that they were trying to improve security on their databases by applying 2 Factor Authentication. Lastly, several users complained that Vodafone was not responding appropriately to their requests in exercise of their rights under Articles 15-22 GDPR. For example, one user complained that Vodafone had not replied at all to a request sent to them via email. Another one explained that Vodafone did reply, but did not promptly correct the user’s personal information as requested, therefore breaching Article 16 GDPR. A last user complained that Vodafone refused to provide the client with information about the purposes of processing his personal data under Article 15(1) because he did not provide them with appropriate Identification, as he used a document with a digital signature. In light of these facts, Italy’s DPA found Vodafone S.p.A in violation of the following GDPR provisions: Article 5(1) and Article 5(2) and Article 25(1): for failing to implement control systems of the personal data collection databases from the first time that they received clients’ complaints, in order to exclude with certainty that services or subscriptions were activated on Vodafone’s databases through illicit or unwanted calls by unrecognized third parties. Article 5(1), Article(2), Article 6(1) and Article 7, because Vodafone received personal data lists by business partners, that those had received from third parties, this all without the user’s appropriate consent. This affected 4,500,000 people in 2019. Violation of Article 5, Article 6 , Article 7 and Article 21 , due to many complaints of undesired contacts from Vodafone through phone call and SMS, that Vodafone blamed on human errors or system errors that were not documented, even following the data subject used their right to object to processing. Violation of Article 24 and Article 32, due to the constant access to databases containing personal data, including full names, phone numbers, phone usage details and payment details. For failing to place appropriate measures to guarantee, or be able to prove, that processing of that data was done in compliance with GDPR and ensuring security and integrity of the data processing techniques used and verify the efficacy of the technical and organisational measures in place to guarantee security of processing. Violation of Article 33(1) for failing to notify the Garante of the violation of personal data Violation of Article 15(1) and Article 16 for failing to act on the requests of the data subjects