The Spanish data protection authority ('AEPD') published, on 16 November 2021, its resolution in proceeding PS/00611/2021, as issued on 4 October 2021, in which it imposed a fine of €70,000 which was subsequently reduced to €56,000 to Vodafone España S.A.U., for violations of Article 6(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following receiving a complaint by a customer. Background to the case In particular, the decision states that the complaint was filed against Vodafone by a customer after a fraudulent third party brought an iPhone from Vodafone in the complainant's name, entered into an instalment plan and changed the complainant's contact detail
News
Spain: AEPD imposes €70,000 fine on Vodafone for processing without legal basis
July 26, 2022
Summary
The Spanish Data Protection Authority (AEPD) fined Vodafone España S.A.U. €70,000, reduced to €56,000 after voluntary payment, for processing personal data without a legal basis, violating Article 6(1) of the GDPR. The fine resulted from a complaint by a customer who was impersonated by a fraudster who purchased an iPhone on an installment plan under the customer's name. The AEPD concluded that Vodafone failed to verify the fraudster's identity adequately, leading to the unlawful processing of the customer's personal data.