- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Vodafone España, SAU – €30,000 Fine (Spain, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Vodafone España SAU was fined for sending invoices for services that a customer never ordered. A fraudster had used the customer's data to create a fake contract. The fine of EUR 30,000 shows the importance of verifying customer information before billing.
What happened
Vodafone España SAU sent invoices for services that were fraudulently ordered using a customer's personal data.
Who was affected
A customer who received invoices for services they did not order due to identity theft involving their personal data.
What the authority found
The Spanish data protection authority ruled that Vodafone España SAU unlawfully transmitted debt information to a collection agency without a valid contract.
Why this matters
This case highlights the need for companies to verify customer identities to prevent fraud. Businesses should have measures in place to check the legitimacy of service orders.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA (AEPD) has imposed a fine on Vodafone España SAU. A data subject had filed a complaint with the AEPD against the data controller. The data subject states that he had received invoices and debits on his bank account for the payment of Vodafone services that he had not booked himself. The data subject also stated that he had been asked to pay for these services by the debt collection company I.S.G.F. Informes Comerciales, S.L.. As it turned out, fraudsters had used the data subject's personal data to conclude a service contract. Vodafone had subsequently canceled the contract for the booked services. Due to a system error, however, the outstanding invoices had not been canceled, which is why they had been forwarded to the collection agency. The AEPD determined that this transmission was unlawful due to the non-existence of a valid contract. The original fine of EUR 50,000 was reduced to EUR 30,000 due to voluntary payment and admission of guilt.
Related Enforcement Actions (6)
Other enforcement actions involving Vodafone España, SAU in ES
Fine
€30K
Details
Fine Date
15 November 2021
Authority
Agencia Española de Protección de Datos
Fine Amount
€30,000
Enforcement Tracker ID
ETid-905
About this data
Cite as: Cookie Fines. Vodafone España, SAU - Spain (2021). Retrieved from cookiefines.eu
Last updated: