[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSDIE-x386ZTIgBJ2Wl1yLfjsq_pnCiMjXyjpH14TSMQ":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":121},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"f7a08779-0b71-4e7d-9023-c55dbe05958a","AEPD (Spain) - PS-00201-2025","aepd-spain-ps-00201-2025-aa6e57","← Older revision Revision as of 11:45, 24 June 2026 Line 65: Line 65: }} }} The DPA fined Vodafone €1,050,000 for unlawfully registering a phone line, disclosing a duplicate invoice to a third party and failing to implement adequate security measures. The DPA fined Vodafone €1,050,000 for the failure to implement adequate security measures, allowing the unlawful registration of an additional phone line and the disclosure of duplicate invoices to third parties. == English Summary == == English Summary ==","Spain's AEPD has fined Vodafone España €1,050,000 for multiple data protection violations. The violations include the unlawful registration of an additional phone line under a customer's name and the disclosure of a duplicate invoice containing personal data to an unauthorized third party via email. The AEPD found that Vodafone failed to implement adequate security measures to prevent these incidents.","Spain's AEPD fines Vodafone €1.05M for data protection violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00201-2025&diff=51995&oldid=51914","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-06-24T11:45:35+00:00","2026-06-24T12:00:16.384026+00:00",7,[17],{"name":18,"type":19},"Vodafone","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":120},[47,76,94],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":77,"name":78,"problem":79,"products":80},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[81,86],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":82,"product_name":83,"url":84,"description":85},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":95,"name":96,"problem":97,"products":98},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[99,107,112],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":108,"product_name":109,"url":110,"description":111},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[],{"slug":122,"title":123,"body":124,"framework_refs":125,"framework_notes":139},"vodafone-espaa-fined-105m-for-unauthorized-line-registration-and-personal-data-disclosure","Vodafone España Fined €1.05M for Unauthorized Line Registration and Personal Data Disclosure","Vodafone España failed to implement adequate security measures to prevent two serious data protection violations: the fraudulent registration of a phone line under a customer's identity without consent, and the sending of a duplicate invoice containing personal data to an unauthorized third party via email. These incidents reflect systemic weaknesses in identity verification, authorization controls, and data handling procedures. Under GDPR, organizations are legally obligated to ensure that personal data is only processed and shared with authorized parties, and failures carry significant financial penalties. This case demonstrates that internal process failures — not just external attacks — can result in major regulatory consequences.",[126,127,128,129,130,131,132,133,134,135,136,137,138],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 83(4)\u002F(5) – Administrative fines","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 AU-9 – Protection of Audit Information","NIST SP 800-53 IA-5 – Authenticator Management","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","ISO\u002FIEC 27001:2022 Annex A 5.15 – Access control","ISO\u002FIEC 27001:2022 Annex A 8.11 – Data masking",{}]