Sanction RGPD Spanish Data Protection Authority (aepd) — Vodafone España, S.A.U. : 56 k€ (2021)
- Autorité de contrôle
- Spanish Data Protection Authority (aepd)
- Pays
- Espagne
- Entreprise / secteur
- Vodafone España, S.A.U.
- Montant de l'amende
- 56 k€
- Date de la décision
- 14 septembre 2021
- Fondement juridique
- Art. 6 (1)
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing. The data subject stated that he received a call from Vodafone in which the latter requested him to pay for three telephone lines. In the call, he explained to Vodafone that the said lines had neither been ordered nor authorized by him, so he asked to send him the invoices. On the invoices, the data subject recognized that the telephone and account numbers did not match its own. During its investigation, the DPA found that an unauthorized third party had concluded the contracts for the lines in the name of the data subject. In addition, the DPA found that Vodafone failed to verify the identity of the person who concluded the contract and to take the necessary precautions to ensure that these incidents do not occur. The original fine of EUR 70,000 was reduced to EUR 56,000 due to voluntary payment.