Vodafone – €740,000 Fine (Greece, 2025)

The data subject is a client of Vodafone Greece (controller). The controller had partnered with DS Phone EE, a company which operated some of the controller’s physical stores (processor). In 2022, a third individual visited store X operated by the processor and using the data subject’s ID card details they registered 15 Vodafone prepaid numbers under her name. They did this by claiming that they were the leader of a group of tourists and wanted to issue prepaid numbers for the whole group under one name for convenience purposes. The data subject only became aware of this in 2023, when she was called by the police in the context of a preliminary investigation for fraud using one of the telephone numbers registered under her name. The data subject immediately informed the controller about the situation. The latter carried out a search in its information system and registered the incident. Later the data subject lodged a complaint with the DPA against the controller, complaining about the unlawful processing of her data. She argued that she never provided her data to this particular store of the processor, as she was a client of a different one, and that she did not consent to the issuance of the phone numbers at hand. She further claimed that when the controller was asked by the Public Prosecutor's Office in the course of the preliminary investigation for fraud to provide information about the owner of the phone number, it provided her name and failed to point out that the number had been illegally activated. As a result, the controller directly pointed to the data subject as the perpetrator of the fraud under investigation, even though it knew the real perpetrator. The processor claimed that the employee who was entrusted with the registration of the data attached the wrong file and mistakenly registered the numbers mentioned above under the identity details of the data subject. It admitted that it had not complied with the client identification procedure. The controller claimed that the practice of issuing multiple phone numbers under one name on behalf of a group of people was not in line with the procedures it followed and it had never instructed or approved such practice. It further claimed that each store has limited access rights to subscribers’ personal data and could only access the files of their own clients. The controller also highlighted that following the incident, it terminated its contractual relationship with the processor. Lastly, with regard to its response to the Public Prosecutor's Office, it claimed that the employee who handled the report, failed to check the information system in which this incident was filed. Regarding the processor: The DPA found that the processor activated 15 prepaid numbers using the data subject’s data, in breach of its obligations to comply with the controller’s instructions and to implement appropriate technical and organisational security measures. Consequently, the DPA imposed a fine to the processor in the amount of €40,000 for the violation of Article 32 GDPR and Article 29 GDPR. Regarding the controller: First, the DPA found that at the time of the incident, the controller had not concluded a data protection agreement with the processor. It also pointed out that controller maintained that access to clients’ identification documents from one store to another was not permitted and technically impossible. Nevertheless, in this case, the store operated by the processor managed to get access to the data subject’s data from another one its stores, the store that the data subject was a client of. Furthermore, even though the controller had not instructed or approved the practice followed by the processor, regarding the registration of multiple phone numbers under one name, it failed to ensure that the processor complied with its procedures and also failed to perform the necessary checks or inspections to detect the breach. Therefore, the DPA held that the controller violated Article 28(1) GDPR and Article 28(3) GDPR. Second, the DPA found that even though the controller was aware of the incident and had registered the information about the illegal activation in its system, it twice provided incorrect information to the Public Prosecutor's Office about the owner of the mobile phone numbers in question. It was therefore established that the controller maintained at least two information systems containing customer data, one of which was not compliant with the principle of data accuracy, in violation of Article 5(1)(d) GDPR. Third, It found that the controller violated Article 12 of Law 3471/2006 on the protection of personal data and privacy in the field of electronic communications (transposition of the e-Privacy Directive), for failing to implement adequate technical and organisational security measures for the processing of personal data. On the basis of the above, the DPA imposed a fine to the controller in the total amount of €700,000 and ordered it to take appropriate technical measures to enhance the security of data processing in regards to the activation of new mobile telephone numbers on existing clients’ data within 3 months.