[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBpIOGWa0XGW_boi5oYydumZWpAPd5ke_iQlqkZXVNv8":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"052122ce-c128-440c-940b-d9f210fd31cd","AEPD (Spain) - PS-00240-2025","aepd-spain-ps-00240-2025-c36710","← Older revision Revision as of 08:49, 23 September 2026 (One intermediate revision by the same user not shown) Line 92: Line 92: }} }} The DPA fined Vodafone €750,000 for infringing [[Article 5 GDPR|Articles 5(1)(f)]], [[Article 28 GDPR|28]] and [[Article 32 GDPR|32 GDPR]] after a data breach affecting the \"Super WiFi\" service, finding inadequate security and that processing began without a valid processor agreement. The DPA fined Vodafone €750,000 for a lack of appropriate security measures leading to a data breach affecting its \"Super WiFi\" service. For the fine, the DPA considered similar previous infringements and the controller’s failure to conclude a processing agreement with its processor. == English Summary == == English Summary == Line 120: Line 120: The DPA also rejected the controller's reliance on encryption. The available documentation did not demonstrate that the affected personal data were encrypted, and documents concerning cryptography referred to pseudonymisation rather than encryption. The DPA also rejected the controller's reliance on encryption. The available documentation did not demonstrate that the affected personal data were encrypted, and documents concerning cryptography referred to pseudonymisation rather than encryption. Third, the DPA held that the insufficient security measures resulted in a loss of confidentiality of personal data and therefore also constituted an infringement of [[Article 5 GDPR|Article 5(1)(f) GDPR]]. The DPA also considered two previous decisions against the controller, PS\u002F00538\u002F2021 and PS\u002F00164\u002F2022, as aggravating factors under [[Article 83 GDPR|Article 83(2)(e) GDPR]]. Both concerned infringements of [[Article 5 GDPR|Articles 5(1)(f)]] and [[Article 32 GDPR|32 GDPR]], and the controller had acknowledged its responsibility in both proceedings. Third, the DPA held that the insufficient security measures resulted in a loss of confidentiality of personal data and therefore also constituted an infringement of [[Article 5 GDPR|Article 5(1)(f) GDPR]]. The DPA also considered two previous decisions against the controller, [https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00538-2021.pdf PS\u002F00538\u002F2021] and [https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00164-2022.pdf PS\u002F00164\u002F2022], as aggravating factors under [[Article 83 GDPR|Article 83(2)(e) GDPR]]. Both concerned infringements of [[Article 5 GDPR|Articles 5(1)(f)]] and [[Article 32 GDPR|32 GDPR]], and the controller had acknowledged its responsibility in both proceedings. When determining the fines, the DPA took into account, among other factors, the nature and gravity of the infringements and the controller's degree of responsibility. It also considered the controller's habitual processing of large volumes of personal data as an aggravating factor under [https:\u002F\u002Fwww.boe.es\u002Fbuscar\u002Fact.php?id=BOE-A-2018-16673 Article 76(2)(b) LOPDGDD]. When determining the fines, the DPA took into account, among other factors, the nature and gravity of the infringements and the controller's degree of responsibility. It also considered the controller's habitual processing of large volumes of personal data as an aggravating factor under [https:\u002F\u002Fwww.boe.es\u002Fbuscar\u002Fact.php?id=BOE-A-2018-16673 Article 76(2)(b) LOPDGDD].","Spain's Data Protection Authority (AEPD) fined Vodafone España €750,000 for violations of GDPR Articles 5(1)(f), 28, and 32 following a data breach affecting its Super WiFi service. The DPA found inadequate security measures, lack of a valid data processor agreement, and false claims of encryption protection. The penalty was aggravated by two previous similar infringements (2021, 2022) and Vodafone's habitual processing of large volumes of personal data.","Spain's AEPD fines Vodafone €750K for data breach in Super WiFi service with inadequate security measures.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00240-2025&diff=53178&oldid=53153","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-23T08:49:17+00:00","2026-09-23T10:00:28.225131+00:00",8,[17,20],{"name":18,"type":19},"Vodafone","vendor",{"name":21,"type":22},"Super WiFi","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":47,"vendors":131},[48,77,102],{"slug":49,"name":50,"problem":51,"products":52},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,87,94],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":83,"product_name":84,"url":85,"description":86},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":78,"product_name":91,"url":92,"description":93},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":103,"name":104,"problem":105,"products":106},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":150},"vodafone-espaa-fined-750k-for-gdpr-failures-including-false-encryption-claims","Vodafone España Fined €750K for GDPR Failures Including False Encryption Claims","Vodafone España suffered a data breach in its Super WiFi service and was fined €750,000 by Spain's AEPD for multiple GDPR violations, including inadequate security measures, absence of a valid data processor agreement, and falsely claiming encryption was in place. The lack of a proper Article 28 data processing agreement means third-party data processors were operating without legally required contractual safeguards, creating uncontrolled risk exposure for personal data. Misrepresenting security controls (such as claiming encryption that did not exist) is particularly serious as it undermines regulatory oversight and incident accountability. This case is aggravated by repeat offences in 2021 and 2022, demonstrating a systemic failure to embed a culture of data protection compliance. Organisations processing large volumes of personal data face heightened scrutiny and proportionally larger penalties when violations recur.",[137,138,139,140,141,142,143,144,145,146,147,148,149],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 28 – Data processor agreements","GDPR Article 32 – Security of processing","GDPR Article 25 – Data protection by design and by default","GDPR Article 30 – Records of processing activities","NIST SP 800-53 SA-9 – External Information System Services","NIST SP 800-53 SC-28 – Protection of Information at Rest","NIST SP 800-53 CA-3 – System Interconnections","CIS Control 3 – Data Protection","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27001:2022 Annex A 5.19 – Information security in supplier relationships","ISO\u002FIEC 27001:2022 Annex A 8.24 – Use of cryptography","ITIL 4 – Risk Management and Supplier Management practices",{}]