[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVM9ffTmtdfqTEcGLA-k0LZFYRlOWr33xL5aEh2pe0x4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"62bd7bc6-3040-4e56-90b8-e49f44c49f15","vodafone-espaa-fined-105m-for-unauthorized-line-registration-and-personal-data-disclosure","f7a08779-0b71-4e7d-9023-c55dbe05958a","Vodafone España Fined €1.05M for Unauthorized Line Registration and Personal Data Disclosure","Vodafone España failed to implement adequate security measures to prevent two serious data protection violations: the fraudulent registration of a phone line under a customer's identity without consent, and the sending of a duplicate invoice containing personal data to an unauthorized third party via email. These incidents reflect systemic weaknesses in identity verification, authorization controls, and data handling procedures. Under GDPR, organizations are legally obligated to ensure that personal data is only processed and shared with authorized parties, and failures carry significant financial penalties. This case demonstrates that internal process failures — not just external attacks — can result in major regulatory consequences.","**Immediate actions:**\n- Enforce strict identity verification (e.g., multi-factor confirmation) before registering any new service or line under an existing customer's account.\n- Audit all outbound communications containing personal data to ensure recipient addresses are validated against verified customer records before sending.\n\n**Long-term improvements:**\n- Implement a formal data minimization and recipient verification policy for all customer-facing communications involving personal data.\n- Establish role-based access controls (RBAC) so that account modifications and document dispatch require dual-authorization from separate staff members.\n- Conduct regular internal audits of customer account management processes to detect unauthorized or erroneous changes.\n\n**Detection & compliance measures:**\n- Deploy automated anomaly detection to flag unusual account activity such as duplicate line registrations or document re-issuance requests.\n- Maintain comprehensive audit logs of all account changes and document disclosures to support incident investigation and regulatory reporting.\n- Schedule periodic GDPR compliance training for all staff handling customer personal data to reinforce lawful processing obligations.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 83(4)\u002F(5) – Administrative fines","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 AU-9 – Protection of Audit Information","NIST SP 800-53 IA-5 – Authenticator Management","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","ISO\u002FIEC 27001:2022 Annex A 5.15 – Access control","ISO\u002FIEC 27001:2022 Annex A 8.11 – Data masking",{},"published","2026-06-24T12:20:52.066216+00:00","2026-06-24T12:20:51.897+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00201-2025&diff=51995&oldid=51914","aepd-spain-ps-00201-2025-aa6e57","AEPD (Spain) - PS-00201-2025",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":41,"name":42,"slug":43,"description":44,"color":45},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":47,"name":48,"slug":49,"description":50,"color":51},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[54,58,62],{"slug":55,"name":56,"problem":57},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":59,"name":60,"problem":61},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":63,"name":64,"problem":65},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]