Vodafone Spain – €50,000 Fine (Spain, 2021)

The complainant noticed a Vodafone charge on his bank account for the use of two mobile phone line. As he had not entered into any contracts with the company, he complained to the Police in Seville and the Consumers and Users Organisation. The company investigated the charges once they received the complaint. It found them to be fraudulent and disconnected the lines. It also cancelled the complainant's existing debt in its systems. The AEPD held that the complainant's personal data were "incorporated into the company's information systems, without him having accredited that he had legitimately contracted, had legitimacy for the collection and subsequent processing of his personal data, or that there was any other cause that would make the processing carried out lawful". It argued Vodafone Spain failed to perform the required due diligence to verify the contracting party was who they claimed to be, notably because the fraudulent contract that was established was unsigned and contained incorrect information (e.g. address, date of birth). It then assessed the degree of responsibility that should be attributed to Vodafone Spain for this breach, and found a clear link between the company's business practices and the breach. It nonetheless took into account that the company reacted with the necessary urgency to remedy the incident as a mitigating factor. Therefore, it fined the company €50,000.