AEPD (Spain) - PS-00201-2025
Spain's AEPD fines Vodafone €1.05M for data protection violations.
Spain's AEPD has fined Vodafone España €1,050,000 for multiple data protection violations. The violations include the unlawful registration of an additional phone line under a customer's name and the disclosure of a duplicate invoice containing personal data to an unauthorized third party via email. The AEPD found that Vodafone failed to implement adequate security measures to prevent these incidents.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Vodafone?
Get an email when a new story names Vodafone, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonVodafone España failed to implement adequate security measures to prevent two serious data protection violations: the fraudulent registration of a phone line under a customer's identity without consent, and the sending of a duplicate invoice containing personal data to an unauthorized third party via email. These incidents reflect systemic weaknesses in identity verification, authorization controls, and data handling procedures. Under GDPR, organizations are legally obligated to ensure that personal data is only processed and shared with authorized parties, and failures carry significant financial penalties. This case demonstrates that internal process failures — not just external attacks — can result in major regulatory consequences.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.