Vodafone España, S.A.U. – €136,000 Fine (Spain, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Vodafone España was fined for allowing unauthorized changes to a customer's account without verifying the person's identity. This matters because it highlights the importance of securing customer data and verifying requests to prevent fraud. The fine was reduced from EUR 170,000 to EUR 136,000 after Vodafone admitted responsibility.
What happened
Vodafone España allowed unauthorized changes to a customer's account without verifying the identity of the requester.
Who was affected
Vodafone customers whose accounts were accessed and altered by fraudsters.
What the authority found
The Spanish DPA found Vodafone violated GDPR by not ensuring proper identity verification before processing requests, breaching data protection rules.
Why this matters
This case underscores the need for companies to implement strong identity verification processes to protect customer data. It serves as a reminder that businesses must be vigilant about security measures to avoid similar penalties.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The Spanish DPA (AEPD) has imposed a fine on Vodafone España, S.A.U. A data subject had filed a complaint against the data controller as unauthorized fraudsters managed to access their Vodafone account and make changes to their contract. During its investigation, the DPA found that Vodafone had carried out the changes without verifying the identity of the person requesting them and determining whether they were actually requested by the data subject. The original fine of EUR 170,000 was reduced to EUR 136,000 due to voluntary payment and admission of responsibility.
Related Enforcement Actions (20)
Other enforcement actions involving Vodafone España, S.A.U. in ES
Fine
€136K
Details
Fine Date
15 March 2023
Authority
Agencia Española de Protección de Datos
Fine Amount
€136,000
Enforcement Tracker ID
ETid-1695
About this data
Cite as: Cookie Fines. Vodafone España, S.A.U. - Spain (2023). Retrieved from cookiefines.eu
Last updated: