AEPD sanctions Vodafone España for inadequate Super WiFi processor agreement and oversight

Case No.: EXP202400702 DECISION ON SANCTIONING PROCEEDINGS Regarding the proceedings conducted by the Spanish Data Protection Agency and based on the following, BACKGROUND FIRST: Notification of a Personal Data Breach On November 23, 2023, this Agency was notified of a personal data breach involving VODAFONE ESPAÑA, S.A.U., Tax ID No. A80907397 (hereinafter, VODAFONE). The facts brought to the attention of this authority are as follows: On November 20, 2023, a VODAFONE supplier (***ENTERPRISE.1, hereinafter ENTERPRISE.1) informed that entity of a security incident that affected a file containing VODAFONE customer data. The affected customers are users of ***APP.1. According to the information provided by the supplier, the attacker (…). The affected data pertains to customers who have downloaded ***APP.1; this information contains (...). (…) SECOND: Initiation of ex officio proceedings As a result of the known facts, on December 14, 2023, the Director of the Spanish Data Protection Agency urged the Subdirectorate General of Data Inspection (SGID) to initiate the preliminary investigative proceedings referred to in Article 67 of Organic Law 3/2018, of December 5, on Data Protection and the Guarantee of Digital Rights (hereinafter, LOPDGDD).

applies Law 3/2018 Art. 67

THIRD: Preliminary Investigative Procedures The Subdirectorate General for Data Inspection proceeded to conduct preliminary investigative procedures to clarify the facts in question, pursuant to the functions assigned to supervisory authorities under Article 57.1 and the powers granted in Article 58.1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and in accordance with the provisions of Title VIII of the LOPDGDD. On November 20, 2023, a VODAFONE supplier reported a security incident that affected a file containing VODAFONE customer data. The customers affected are (…).  Number of affected individuals according to the notification: (…)  Type of data according to the notification: (…) C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/49  The data controller states that the incident was communicated to those affected on December 28, 2023. 1.

applies Art. 57, Art. 58

Analysis of the data breach. 1.1. Chronology of events. The incident originated from a cyberattack suffered by the processor, which affected the personal data of the controller’s customers. According to the controller, on 11/20/2023, its vendor ***ENTERPRISE.1, acting in the role of processor, informed it of a security incident that affected a file containing VODAFONE customer data. The data controller states: “***ENTERPRISE.1 is a VODAFONE provider of software services related to the Super Wifi 5 product, which is offered by VODAFONE Spain. To provide these services, ***ENTERPRISE.1 has developed an application through which it processes and stores data from VODAFONE users who use the application.” The affected customers (…). (…) According to the information provided, ***ENTERPRISE.1 became aware of the unauthorized access on 11/13/2023 as a result of a post on social media containing messages alluding to the incident.

(…) 1.3. Impact of the breach. Possible consequences for those affected. The data controller indicates the following number of affected individuals and the type of data compromised:  Total number of affected customers: (…) o (…) Additionally, the data controller notes: “Of these potentially affected customers, (…)”. The data controller provides the following assessment of the incident: “(…). Therefore, the main consequences for those affected could include stress, irritation, confusion, as well as becoming targets of phishing campaigns or data theft.” 3. Security Measures. 3.1. Measures Implemented Prior to the Data Breach. The data protection officer provides the following information regarding security measures in place prior to the incident:  (…) C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 3/49 (…) 4. Regulations on data processing. 4.1. Data Processing Agreement. As previously indicated, the roles among the entities are as follows: VODAFONE acts as the controller, and ***ENTERPRISE.1 (…).

A copy of the data processing agreement entered into between VODAFONE and ENTERPRISE.1, (…). This agreement confirms that it includes, among other aspects:  “The purpose of the agreement is (…)”.  “The data importer shall process personal data solely in accordance with documented instructions from the controller.”  “(…) There was a sub-processing agreement between ***ENTERPRISE.1 and ***ENTERPRISE.2 for the technical operation of the service. A copy of that contract, in English, signed on March 2, 2022, is provided. (…). 4.2. Other documentation. A copy of the risk analysis conducted, in English, is provided. The data controller states: “This questionnaire was completed by the provider to verify that ENTERPRISE.1 complied with VODAFONE’s minimum security requirements in its provision of services to VODAFONE.” (…) FOURTH: Turnover According to the report generated by the AXESOR tool, the entity VODAFONE has a turnover of 2,909,851,000 euros for the year 2024.

FIFTH: Agreement to initiate disciplinary proceedings and responses thereto. On June 13, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate disciplinary proceedings against the respondent, in accordance with the provisions of Articles 63 and 64 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged violation of Article 5.1.f) of the GDPR, Article 32 of the GDPR, and Article 28 of the GDPR, as defined in Article 83(5) of the GDPR (the first) and Article 83(4) of the GDPR (the latter two). Upon notification of the aforementioned decision to initiate proceedings in accordance with the provisions of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP); on July 14, 2025, the respondent submitted a written statement of arguments, which were addressed in the proposed resolution.

applies Art. 83(4), Art. 83(5), Art. 5, Art. 28, Art. 32 , Law 39/2015 Art. 63, Law 39/2015 Art. 64

C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 4/49 SIXTH: Proposed Resolution On November 28, 2025, a proposed resolution was issued and served on VODAFONE on December 5, 2025. VODAFONE requested an extension of the deadline to respond, which was granted by a written notice dated December 10, 2025. On December 30, 2025, VODAFONE filed a brief of arguments in which it it states, in summary: that VODAFONE has not violated Articles 28, 32, and 5(f)—all of which are articles of the GDPR—essentially because the data processing agreement was in effect on the date of the incident. Based on the proceedings conducted in this case and the documentation on file, the following has been established: ESTABLISHED FACTS FIRST: Beginning on November 11, 2023, VODAFONE’s information systems were the target of a cyberattack that affected (…). SECOND: As a result of the cyberattack, the intruder gained access to personal data of VODAFONE customers who were using said service.

applies Art. 5, Art. 28, Art. 32

Consequently, a data breach occurred, compromising the confidentiality of the data. THIRD: On November 23, 2023, this Agency was notified of this personal data breach by VODAFONE. FOURTH: The personal data affected by the cyberattack, in terms of volume and categories, were as follows: Categories of data Categories of data Volume of data of data subjects Customers (…) (…) individuals and microenterprises TOTAL AFFECTED (…) FIFTH: The causes of the loss of confidentiality were as follows: (…) SIXTH: The following deficiencies have been identified in the technical and organizational measures of all kinds related to the data breach that led to the loss of confidentiality - (…) C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 5/49 SEVENTH: A lack of security measures has been identified in the processing of personal data, not directly related to the data breach that caused the loss of confidentiality: - (…) EIGHTH: At the time the data breach occurred, there was no validly executed data processing agreement between VODAFONE and ***ENTERPRISE.1.

(…). LEGAL GROUNDS I Jurisdiction In accordance with the powers granted by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) grants to each supervisory authority, and in accordance with Articles 47, 48.1, 64.2, and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency has jurisdiction to resolve this proceeding. Likewise, Article 63.2 of the LOPDGDD provides that: “The proceedings handled by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, this Organic Law, the adopted to implement it, and, to the extent they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures.” II Preliminary Issues 1. General Aspects of Processing Article 4(1) of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (‘the data subject’); an identifiable natural person is one whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.”

applies Art. 4(1), Art. 58 , Law 3/2018 Art. 47, LOPDGDD Art. 63

Article 4(2) of the GDPR defines “processing” as: “any operation or set of operations performed on personal data or sets of personal data, whether whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 6/49 Article 4(7) of the GDPR defines the “controller” or “data controller” as: “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing; if Union law Union or of the Member States determines the purposes and means of the processing, the controller or the specific criteria for its appointment may be established by Union or Member State law.”

applies Art. 4(2), Art. 4(7)

In turn, Article 4(8) of the GDPR defines the “processor” as the natural or legal person, public authority, agency, or other body that engages in personal data processing on behalf of the controller. 2. Liability for Infringements In the present case, in accordance with the provisions of Articles 4(1) and 4(2) of the GDPR, it is established that personal data processing has taken place, since VODAFONE carries out, among other processing activities, the collection and storage of personal data of natural persons, including identifying information, documentary data, contact information, data relating to contracted services, and economic or financial data. VODAFONE carries out this activity in its capacity as the controller, since it is the entity that determines the purposes and means of such activity, pursuant to Article 4.7 of the GDPR. Both in the notifications regarding the breach and in its responses to the requests for information from this Agency’s Inspectorate, VODAFONE asserts its lack of liability with respect to the events that occurred based on two factors.

applies Art. 4(1), Art. 4(2), Art. 4(8), Art. 4

First, that the breach physically occurred in the systems or infrastructure of ***ENTERPRISE.1 and its data processor ***ENTERPRISE.2. second, that it had entered into the appropriate data processing agreement with said enterprise, ***ENTERPRISE.1. This agreement reportedly included instructions to the processor, particularly those relating to security measures for personal data. With regard to the liability of the controller or processor, indeed, the principle of liability set forth in Article 28 of the LRJSP provides that: “Only natural and legal persons may be sanctioned for acts constituting an natural and legal persons, as well as—when a law grants them the capacity to act—groups of data subjects, associations, and entities without legal personality, and independent or autonomous estates, which are found liable for such acts due to willful misconduct or negligence.” However, the manner in which liability is attributed to legal entities does not correspond to the forms of intentional or negligent culpability that are attributable to human conduct.

applies Art. 28

Thus, in the case of violations committed by legal entities, although the element of culpability must be present, it is necessarily applied differently than it is with respect to natural persons. According to Constitutional Court Ruling 246/1991, of December 19, Rec. 1274/1988, “(...) this distinction distinct interpretation of the legal entity’s liability for the offense stems from the very nature of the legal fiction to which these entities are subject. They lack the element of volition in the strict sense, but not the capacity to violate the rules to which they are subject.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 7/49 Capacity to commit an offense and, therefore, direct culpability stemming from the legal interest protected by the rule that is violated and the need for such protection be truly effective and the risk that, consequently, must be assumed by the legal entity subject to compliance with said rule” (in this regard, Supreme Court Ruling of November 24, 2011, Case No. 258/2009).

For its part, the Judgement of the Court of Justice (Grand Chamber) of December 5, 2023, rendered in Case C-807/21, states: “41. Furthermore, the Court of Justice has already held that any natural or legal person who, in pursuit of its own objectives, influences the processing of personal data and thus participates in determining the purposes and means of the processing may be considered a controller (see, in this regard, the judgement of July 10, 2018, Jehovan todistajat, C-25/17, EU:C:2018:551, paragraph 68). 42. Thus, it follows from the wording and purpose of Article 4(7) of the GDPR that the EU legislature has not established, for the purposes of determining liability under that Regulation, a distinction between natural persons and legal entities, since that liability is subject solely to the requirement that they, alone or jointly with others, determine the purposes and means of the processing of personal data. 43.

applies Art. 4(7)

Therefore, without prejudice to the provisions of Article 83(7) of the GDPR regarding public authorities and bodies, any person who meets this requirement—whether a natural person, legal person, public authority, agency, or other body—shall be liable, in particular, for any infringement referred to in Article 83(4) to (6) of the GDPR committed by that person or on that person’s behalf. 44. With regard to legal entities, this implies, on the one hand—as the Advocate General has essentially noted in points 57 through 59 of his Opinion— that they are liable not only for infringements committed by their representatives, directors, or managers, but also by any other person who acts within the scope of those legal entities’ business activities and on their behalf. On the other hand, the administrative fines provided for in Article 83 of the GDPR in the event of such infringements must be capable of being imposed directly on legal entities when they can be classified as controllers of the processing in question.

applies Art. 83(4), Art. 83(7), Art. 83

(…) 46. Thus, a combined reading of Articles 4(7), 83, and 58(2)(i) of the GDPR shows that an administrative fine for an infringement referred to in Article 83(4) to (6) may also be imposed on legal entities when they act as controllers. Conversely, no provision of the GDPR allows for the conclusion that the imposition of an administrative fine on a legal entity acting as a controller is subject to a prior finding that the infringement was committed by a specific natural person.” The Role of the Processor C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 8/49 The role of the processor arises from the need to address phenomena such as the outsourcing of services by enterprises and other entities, such that in cases where the controller entrusts a third party with the provision of a service that requires the processor to process personal data on its own behalf, the processing or processing operations are carried out by the processor, in the name and on behalf of the controller, as if it were the controller itself carrying out the processing.

applies Art. 4(7), Art. 58(2)(i), Art. 83(4), Art. 83

In the present case, according to the information provided by VODAFONE, the services entrusted to the processor would be, according to VODAFONE’s response to the Agency inspector’s request, the following “***ENTERPRISE.1 is a service provider for VODAFONE (…), which is offered by VODAFONE Spain. To provide these services, ***ENTERPRISE.1 has developed an application through which it processes and stores data on VODAFONE Users who use the application (hereinafter, the “application”). The app offers the user (…). According to the notification issued by ***ENTERPRISE.1, (…).” The website www.VODAFONE.es provides an explanation of (…). The existence of a processor depends on a decision made by the controller, who may decide to carry out certain processing operations on their own or to contract out all or part of the processing to a processor. In other words, in order to qualify as a processor, the processor must not have any self-interest regarding the outcome of the processing for which it is engaged, notwithstanding the financial compensation it receives for the service provided, which is the case here.

Processors have no interest of their own; they act on behalf of and in the name of the controller, carrying out the controller’s instructions and for the controller’s purposes, and this is what determines that they are processors from the outset. This means that the controller is liable for actions contrary to the GDPR carried out by its processors, unless the latter acted as actual controllers, deciding on the purposes and means of the processing—a situation that did not occur in the present case. EDPB Guidelines 7/2020 on the concepts of “controller” and “processor” in the GDPR, version 2.0, adopted on July 7, 2021, state that, “30 In line with the fact-based approach, the word ‘determines’ means that the entity that actually exercises decisive influence over the purposes and means of the processing is the controller. Generally, the data processing agreement specifies who is the determining party (the controller) and who is the party that follows instructions (the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 9/49 processor).

Even when the processor provides a service that is predefined in a specific manner, it must submit a detailed description of the service to the controller, and the controller must make the final decision regarding approval of how the processing will be carried out and request any changes it deems necessary. Furthermore, the processor may not modify, at a later time, the essential elements of the processing without the approval of the controller. (…) 39. The question is where to draw the line between decisions reserved for the controller and those that may be left to the discretion of the processor. It is clear that decisions regarding the purpose of the processing must always rest with the controller. Responsibility, therefore, rests with the party that determines the means and purposes of the processing. In this case, VODAFONE ESPAÑA S.A.U. As stated in the Judgement of the National Court—Administrative Chamber, dated February 8, 2024 (Case No.: SAN 595/2024), in its Legal Rationale Third party: “The first ground for appeal raised by the plaintiff is that it cannot be considered the principal offender of the alleged violation, insofar as the processors did not carry out the processing in accordance with the procedures determined by ***ENTERPRISE.3; and, therefore, pursuant to the provisions of Art. 28.10 of the GDPR, they should have been considered by the Spanish Data Protection Agency (hereinafter AEPD) as controllers, and the sanctioning proceedings that are the subject of this litigation should have been initiated—where applicable—against them.

applies Art. 28

(…) However, it has not been proven that the aforementioned enterprises, as processors for the plaintiff, determined the purposes and means of the processing, nor did they use the plaintiff’s customer data for their own purposes, nor did they interacted with data subjects outside the structure and trade name of the appellant company; rather, they acted under the plaintiff’s name to fulfill the plaintiff’s purpose, using the plaintiff’s systems to carry out transactions with customers. Therefore, Article 28(10) of the GDPR cannot be invoked to attribute alleged liability to the processors, which, moreover, would imply the exoneration of the controller, that is, the appellant company.” In accordance with the provisions of the Supreme Administrative Court ruling of October 29, 2024, Case No. 1824/2021, the controller has the obligation, with respect to its processors, to supervise them by implementing all types of security and monitoring systems and measures security and monitoring to verify and demonstrate compliance with the GDPR: “the data controller has the obligation to supervise the processing carried out by its processors by implementing all types of security and monitoring systems and measures that verify compliance with their instructions and compliance with data protection regulations, and, pursuant to the principle of proactive accountability (Article 5.2 of the GDPR), be able to demonstrate it.”

applies Art. 28(10), Art. 5

C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 10/49 For its part, the recent Judgement of the Court of Justice (Grand Chamber) of December 2, 2025, rendered in Case C-492/23, establishes with respect to the controller: “56. Article 4(7) of the GDPR broadly defines the concept of the controller or controller as the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. 57. The purpose of this broad definition is, in accordance with the GDPR, to to ensure effective protection of the fundamental rights and freedoms of natural persons and a high level of data protection of every individual’s right to the protection of personal data concerning them (Judgement of December 5, 2023, C-682/2021…). 58. Thus, any natural or legal person who, in pursuit of its own objectives, influences the processing of such data and thereby participates in determining the purposes and means of the processing may be considered a controller of such processing (Judgement of December 5, 2023, C-682/2021…) (…) 71.

applies Art. 4(7)

Indeed, the Court of Justice has already held, in essence, that the natural or legal person who influences determination of the means of processing any natural or legal person who exerts a decisive influence on the collection and transmission of personal data, or even anyone who, through their configuration actions, influences—based on their objectives of management or promotion of their activities—the processing of such data (Judgement of June 5, 2018, C-40-17…). (…) 85. Second, Chapter IV of the GDPR specifies the scope of the obligations imposed on the controller of personal data, in accordance with the principle of accountability set forth in Article 5(2) of the GDPR. 86. Pursuant to this provision, the controller is responsible for compliance with the provisions of paragraph 1 of that same article and must be able to demonstrate that it complies with each of the principles set forth in paragraph 1, such that the burden of proof rests with the controller (Judgement of May 4, 2023, C-60/22 …). 87.

applies Art. 5(2)

The principle of accountability is further elaborated, in particular, in Article 24 of the GDPR (see, to that effect, the Judgement of January 25, 2024, MediaMarktSaturn, C-687/21). That provision requires that, taking into account the nature, scope, context, and purpose of the processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons, the controller implement appropriate technical and organizational measures ensure and be able to demonstrate that the processing complies with said Regulation. 88. Thus, Articles 5(2) and 24 of the GDPR impose on the controller of personal data general obligations of accountability and compliance. These provisions require the controller to adopt measures aimed at preventing possible violations of the rules established by the GDPR, in order to guarantee the right to data protection (see, in this regard, the Judgement of October 27, 2022, C-129/21).

applies Art. 5(2), Art. 24

C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 11/49 89. In this regard, Article 25(1) of the GDPR imposes on the controller the obligation to implement, both when determining the means of processing and at the time of the processing itself, appropriate technical and organizational measures designed to effectively implement the principles of data protection and to incorporate the necessary safeguards into the processing, in order to comply with the requirements of this Regulation and protect the data subject rights. Furthermore, Article 25(2), concerning data protection by default, provides, in particular, that the appropriate technical and organizational measures that the controller must implement for this purpose must ensure that, by default, personal data is not accessible, without the involvement of the data subject, to an indeterminate number of natural persons. (…) 117.

applies Art. 25(1), Art. 25(2)

The Court of Justice has already held that the reference in Article 32(1) and (2) of the GDPR to a level of security appropriate to the risk and to adequacy of the level of security makes it clear that this Regulation establishes a risk management framework and that it in no way seeks to achieve erasure of the risks of personal data breaches (Judgement of December 14, 2023, C-340/21). 118. Thus, from the wording of Article 32 of the GDPR, in conjunction with Article 24 of the same Regulation, it follows that Article 32 merely requires the controller to implement technical and organizational measures designed to prevent, to the greatest extent possible, any personal data breach. The appropriateness of such measures must be assessed on a case-by-case basis, by examining whether the controller has adopted those measures taking into account the various criteria set forth in the aforementioned articles and the data protection needs specifically inherent to the processing in question and the risks it entails (see, in this regard, the Judgement of December 14, 2023, C-340/21) This is the case even in light of the processor's data processing agreement.

applies Art. 32(1), Art. 32(2), Art. 24, Art. 32

However, to elaborate further—and as will be analyzed more thoroughly later—since the processor's data processing agreement is itself the subject of the alleged infringement, it cannot be considered validly concluded and in force as of the date of the data breach. The copy provided by VODAFONE shows that, in the space where the signatures of the enterprises’ authorized representatives appear, there is the electronic signature of two VODAFONE representatives; however, among the characteristics of that signature is the date on which it was created. And this is “2024.09.04.” It can be seen that it is in Anglo-Saxon format and refers to September 4, 2024. Even under the interpretation most favorable to VODAFONE (April 9, 2024), this would be well after the data breach occurred, which took place on November 20, 2023. Consequently, VODAFONE should be held liable as both the controller and the person responsible for the violations that occurred in connection with the data breach.

III Response to the Arguments Submitted Regarding the Initiation Agreement C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 12/49 The order of presentation follows that of the written arguments submitted in response to the opening agreement FIRST: Violation of Article 28 of the GDPR Essentially, the arguments presented by VODAFONE regarding this violation are divided into two parts. On the one hand, regarding the commission of the violation itself; on the other, regarding the amount of the proposed penalty. Commencement of the Infringement of Article 28 of the GDPR The alleged infringement consists of the fact that the processor agreement with the enterprise ***ENTERPRISE.1 was signed after the data breach involving personal data occurred, meaning it was not in effect as of that date. Although the respondent acknowledges this fact (…). VODAFONE considers that the lack of a signed contract does not in itself imply the non-existence of the contract or, consequently, a violation of Article 28 of the GDPR.

applies Art. 28

It asserts that, in accordance with the Civil Code, the contract exists from the moment of the convergence of the parties’ intentions. As evidence of this assertion, the pleadings indicate that there is a risk analysis document from ***ENTERPRISE.1 dated December 22, 2022, and that on March 23, 2023, VODAFONE conducted an audit of its processor (document attached to substantiate this). This claim by VODAFONE cannot be accepted under any circumstances. To this end, we must refer to Article 28(3) of the GDPR, which provides that: “Processing by a processor shall be governed by a contract or other legal act in in accordance with Union or Member State law, which binds the processor in relation to the controller and sets out the subject matter, duration, nature, and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller.”

applies Art. 28(3)

According to the documentation and arguments submitted by the respondent, there is evidence of a contract signed on September 6, 2024, which includes a reference indicating that it entered into force on December 22, 2022. However, the only evidence of the contract’s conclusion would be the signature (which guarantees the involvement, knowledge, and consent) of the parties to the contract. Thus, VODAFONE has not demonstrated that the contract was validly entered into prior to the date of signature stated in the documentation on file, that is, December 22, 2022. It should be noted that the “Guidelines 07/2020 on the Concepts of ‘Controller’ and ‘Processor’ in the GDPR” establish the obligation to formalize a data processing agreement, and that such an agreement be recorded on a stable and durable medium: “(101) This legal act must be in writing, with electronic format permitted. Therefore, agreements not formalized in writing (with C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 13/49 regardless of their completeness or validity) cannot be considered sufficient to meet the requirements set forth in Article 28 of the GDPR.

applies Art. 28

To avoid any difficulty in proving the validity of the contract or other legal act, the EDPB recommends ensuring that the necessary signatures have been included in the legal act in accordance with the provisions of applicable law.” “(103) Since the Regulation establishes a clear obligation to enter into a written contract, when no other relevant legal act is in force, the absence of a contract will constitute a violation of the GDPR.” In ordinary legal practice, there is nothing to prevent parties from entering into contracts that provide for legal effects prior to the date of signature. This can be done in areas such as civil or commercial law. For example, an employment contract that provides for a pay raise effective prior to the date of signature. However, in the context of the fundamental right to data protection, we cannot overlook the purpose of the obligation established in Article 28(3) of the GDPR, which requires that a contract between the controller and the processor be in place from the outset.

applies Art. 28(3)

The data processor processes personal data for which the data controller is responsible, and it is necessary for the data controller to establish the necessary safeguards and procedures to ensure that the provisions of the GDPR are complied with—by both the data controller and the processor. Recall that the processor acts on behalf of the data controller. The GDPR seeks to prevent the increasingly widespread practice of contracting and subcontracting services by the controller (outsourcing in practice) from leading to an evasion of responsibility regarding compliance with obligations in this area. The processing of personal data by the processor begins the very moment it starts performing the functions entrusted to it by the controller. And from that moment on, the data processing agreement must be validly entered into, signed, and formally finalized, as we have seen established in Guidelines 07/2020.

This is to ensure that the processor is formally and substantively bound to comply with the obligations of the GDPR. In this regard, it would be inconsistent with the GDPR to adopt a practice whereby, as VODAFONE asserts, a data processing agreement were formally entered into on a date such as September 2024, while stipulating that the contract’s entry into force occurred in December 2022. Throughout that entire period, there would be no formally executed contract and, consequently, no guarantees that the processor would be subject to the obligations of the GDPR. The argument, therefore, cannot be upheld, since the alleged retroactive effect of the contract’s effective date does not remedy the absence of a valid legal relationship during the period between the start of processing and the actual formalization of the contract. The existence of a document with an earlier effective date has no practical effect in terms of data protection if there is no conclusive evidence that both parties had expressed and documented their consent in accordance with the requirements of Article 28(3) of the GDPR prior to the start of processing operations.

applies Art. 28(3)

Consequently, as long as the contract is not formally finalized—that is, signed and in a written format C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 14/49 , the legal obligation binding the processor to the controller cannot be considered fulfilled, nor can the effective application of the measures and safeguards established by the GDPR be deemed guaranteed. Similarly, accepting the retroactive effect of a data processing agreement would render the requirement set forth in Article 28 of the GDPR meaningless, allowing for the ex post regularization of situations in which processing has already been carried out without the necessary legal safeguards. This would contravene the principle of accountability, as it would cover periods during which the processor acted without being formally subject to the obligations imposed by the GDPR. Needless to say, this breach is in no way mitigated by the fact that, as VODAFONE asserts, an audit or inspection was conducted on the processor—a matter on which we will rule later.

applies Art. 28

The obligation under Article 28 is the formal execution of a contract governing the relationship between the controller and the processor and requiring the latter to comply with the obligations of the GDPR. And in this case, the contract was neither validly executed nor in effect at the time the breach occurred. This argument must therefore be dismissed. Circumstances for Determining the Amount With regard to this section of the arguments, two fundamental aspects should be noted. First, the respondent characterizes all of the circumstances assessed in the decision to initiate proceedings as “aggravating.” And it must be clarified that this is not the case. In accordance with Guidelines 04/2022 on the calculation of fines under the GDPR, dated May 24, 2023, issued by the European Data Protection (hereinafter, the “Fines Guidelines”), successive steps are followed to determine the amount of the penalty.

applies Art. 28

The first step is to determine the initial amount of the penalty. This is covered in Chapter 4, “Starting Point for the Calculation,” of the Guidelines (paragraphs 46 et seq.). To calculate the initial amount, certain factors expressly identified in the Guidelines are taken into account. These include (in addition to, obviously, the annual turnover) the “nature, gravity, and duration of the infringement” (paragraphs 53 et seq.); the “intentional or negligent nature of the infringement” (paragraphs 55 et seq.), and the “categories of data affected” (paragraphs 57 et seq.). The application of these factors determines what would be the base amount of the fine, to which aggravating or mitigating circumstances would then be applied. In the present proceedings, for each violation, the circumstances set forth in the aforementioned Chapter 4 of the guide have been taken into account in calculating the initial amount of the penalty.

Specifically, the volume of business, the severity of the violation, and the degree of intent or negligence involved, as well as, where applicable, the type of personal data affected. Subsequently, the existence of aggravating circumstances was assessed. Among these were the existence of previous penalties and the respondent’s involvement in the processing of personal data. This was stated in the decision to initiate proceedings, distinguishing between C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 15/49 circumstances for determining the amount, and, subsequently, aggravating or mitigating factors. We will now analyze the specific circumstances invoked.  Nature, gravity, and duration of the violation (Art. 83(2)(a) GDPR). There is a discrepancy VODAFONE disputes the applicability of this circumstance, particularly the consideration of the number of affected customers (...), arguing solely that, since a validly executed contract exists, this circumstance cannot be taken into account.

applies Art. 83(2)(a)

Since the disagreement regarding this circumstance stems from the disagreement over whether the violation was committed in the first place, we refer to the response already provided above.  Intent or negligence (Art. 83(2)(b) GDPR). In VODAFONE’s opinion, negligence cannot be considered aggravated by the fact that this enterprise regularly outsources services, since this aspect would already be taken into account as an aggravating factor in connection with the routine processing of personal data, which has also been applied. The initial decision makes clear that, indeed, the negligence is particularly serious due to the circumstances in which the events attributed to the respondent occurred, which in practice resulted in a relationship with a processor with whom it had not previously formalized the conditions under which the processing of personal data entrusted to it was to be carried out; particularly in terms of guarantees and safeguards for the data subjects whose data were being processed.

applies Art. 83(2)(b)

This is a specific aspect considered in assessing the severity of the negligence, and it is not the only factor applied for this purpose, as the long period of time that has elapsed since this obligation took effect under the GDPR (May 2018) is also mentioned. It is specifically taken into account because, as indicated, the high volume of outsourced contracts should make this an aspect requiring special vigilance and supervision on the part of the controller. A separate issue is the aggravating factor of a connection to the routine processing of personal data under Article 76 of the GDPR, which applies to the processing of personal data of end customers in relation to general aspects of contracting, billing, complaints, etc., without being specifically related to the outsourcing to data processors. However, it also applies to this violation as an additional and distinct factor.  Categories of data affected (Art. 83(2)(g) GDPR).

applies Art. 83(2)(g), Art. 76

VODAFONE argues that this circumstance should not be taken into account: “it is applicable: as is evident from the record, (…)” Indeed, upon reviewing both the initial agreement and the documents on file, it is confirmed that (…) was not being processed by ENTERPRISE.1 and, therefore, was not affected by this data breach. In any case, given that the type of personal data affected is a circumstance (neither C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 16/49 aggravating or mitigating factor) in determining the initial amount, the affected data has been included. Since the initial decision cited the particularly serious nature of having been affected (…), when in fact this is not the case, it is proposed to reduce the amount of the penalty for the violation of Article 28 of the GDPR.  Aggravating factor: the connection between the infringer’s activity and the processing of personal data processing (Art. 76 LOPDGDD).

applies Art. 28 , LOPDGDD Art. 76

This aggravating factor applies in these proceedings when determining the amount of the fine. VODAFONE objects to this, stating that VODAFONE’s primary activity is not the processing of personal data, but rather the provision of electronic communications . It further adds that the mere fact of processing personal data on a regular basis cannot constitute an aggravating factor in liability. In this regard, it should be noted that VODAFONE’s primary activity, while not directly involving the processing of personal data, necessarily entails necessarily the routine processing of such data. It enters into contracts with citizens, responds to their inquiries, resolves their complaints, and handles their billing, among many other services. In other words, it is not a merely ancillary or indirect activity; rather, the provision of provision of electronic communications services involves the performance of multiple processing operations.

Furthermore, the number of customers of this operator is in the millions. This is precisely the purpose of the aggravating factor provided for in Article 76.2.b) of the LOPDGDD. A higher standard of diligence in the processing of personal data is required of an enterprise (in this case, a large enterprise) whose regular activity involves the continuous processing of personal data (and with the involvement and guidance of a data protection officer) than to those who do so only occasionally—whether they are individuals or small enterprises—and do not have the same resources. Therefore, this aggravating factor is fully applicable to VODAFONE in this case. SECOND: Violation of Article 5.1.f) of the GDPR The respondent divides this section into four types of arguments, which will be addressed in the order in which they appear in the document. “Preliminary clarifications” regarding the loss of confidentiality In this section, VODAFONE states the following: - First, the fact that (…). - Contrary to what is stated in the opening decision, VODAFONE did carry out oversight measures regarding its processor, (…) (reference is made to documents submitted to the inspector).

applies Art. 5 , LOPDGDD Art. 76

C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 17/49 Regarding these allegations, the following should be noted: with respect to the point of entry, a distinction must be made between what that point of entry was and what measures (or rather, the lack thereof) led to the loss of confidentiality. It is true that the breach occurred because (…), but it is equally true that it was successful due to certain deficiencies identified in the information systems. Primarily, this third party’s system relied solely on (…). With regard to data encryption, it should first be noted that the respondent’s arguments do not specify in which specific document among those submitted in the proceedings this measure is addressed. Upon analyzing these documents, it is observed that the only reference to encryption is contained in VODAFONE’s first response to the AEPD inspector. There, among the measures implemented prior to the breach, the following is listed: (…).

As can be seen, encryption is applied to communications, albeit with somewhat unclear wording. The data was in plain text and accessible based on the information available. In fact, the initial breach notification states as much: (…) Additionally, in one of the documents provided by VODAFONE in response to the inspector’s request—which, as will be seen later, is intended to demonstrate the existence of audits of the data processor—the “Cryptography” section mentions only “pseudonymization” techniques and never encryption or encoded data. Regarding possible audit and monitoring activities concerning the operations of the processor, VODAFONE refers to two form-type documents; one dated 12/22/2022 and the other undated (according to VODAFONE’s assertions, the latter would be from March 30, 2023. Neither is signed. Well, aside from these issues, these documents suffer from the following shortcomings: - The method of preparation or work procedure is not detailed.

Rather, it appears to be based on statements by the processor itself. In any case, the “fieldwork” carried out to verify whether the measures were in place is not described. - In the section on risk management, the document merely lists a series of principles and objectives, without specific measures, stating that they are “fully in place.” Of course, it does not address any of the measures that should be implemented in accordance with the deficiencies identified in this procedure. - As mentioned above, the “Cryptography” section refers only to “pseudonymization” techniques and never to encryption or encoding. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 18/49 - Most importantly, in the Information Security section, the following measure is listed as “Fully Operational”: (unofficial translation from English): “Development and production environments require a VPN for access, , and access is granted only for professional purposes.

All our internal systems require MFA, and no personal devices may be used to access the development and production environments.” Given the deficiencies identified regarding the lack of a VPN for accessing ***ENTERPRISE.2 and the lack of two-factor authentication, it is reasonable to question the effectiveness of controls and audits such as those conducted; thus, the argument used in the opening agreement—that the data controller’s The processor was limited to conducting a formal compliance check on the processor, without detecting the problems that existed. Possible liability of the processor for the violations. According to VODAFONE’s allegations, the processor ENTERPRISE.1 deviated from the instructions given by VODAFONE. It includes a list of specific mandates that the data processor allegedly failed to comply with. The response to this allegation must be addressed from two perspectives.

First, whether the existence of a validly entered into data processing agreement allows, in the event of a breach of any of the instructions, for the processor to be held responsible for committing the infractions. Second, whether, as VODAFONE asserts, said agreement contained precise instructions such that, had they been strictly followed by the processor, the personal data breach would not have occurred. We will now focus on the first of these issues. That is, whether liability for the violations committed in this case could fall on the processor. This depends on the arguments put forward by VODAFONE, both those relating to the pre-contractual phase (selection of the processor), those during the term of the contract (organizational and technical measures provided for therein), and those following the termination of the contract (remedying the effects of the breach). It should be clarified that this Agency does not consider that a data processing agreement was validly entered into until September 6, 2024; for this purpose, we refer both to the response to the arguments regarding Article 28 and to the legal basis for this proposal, which analyzes that violation.

applies Art. 28

Turning now to the second issue (whether there were specific measures in the data processing agreement), it should be noted that the agreement cannot be considered validly concluded and in force until September 6, 2024, and thus at after the breach (we refer to the response to the allegations and the legal basis regarding the violation of Article 28 of the GDPR). Therefore, it is not appropriate to analyze whether that contract contained specific instructions whose compliance would have prevented the breach. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 19/49 Absence of Fault In this section, the respondent raises no new arguments. It merely reproduces Article 28.1 of Law 40/2015: “Only natural and legal persons may be sanctioned for acts constituting an natural and legal persons, as well as—when a law recognizes their capacity to act—groups of affected parties, associations, and entities without legal personality, and independent or autonomous estates, which are found liable for such acts on the grounds of willful misconduct or negligence.”

applies Art. 28 , Law 40/2015 Art. 28

It goes on to state that, in accordance with the interpretation provided by the , invoking the absence of fault will not suffice for exoneration; rather, it will be necessary to have exercised the due diligence required of the party asserting its absence (among others, the Supreme Court Judgement of January 23, 1998. And to prove such diligence, it does nothing more than refer to arguments already made: the measures it had imposed on its processor, its diligence in mitigating the effects of the breach, and the alleged oversight actions it had carried out with respect to said processor. All of this has already been addressed in previous sections of this brief. Both with regard to the possible liability of the processor and, in general, regarding the measures implemented (or their absence). In any case, with regard to the principle of fault, it is fully applicable to case is the Supreme Court ruling of October 17, 2007 (Case No. 63/2006), which, after noting that entities whose business operations involve the continuous processing of customer and third-party data must observe an adequate level of diligence, states: “[...] the Supreme Court has held that negligence exists whenever a legal duty of care is disregarded, that is, when the offender does not act with the due diligence required.

And in assessing the degree of diligence, special consideration must be given to whether or not the party in question is a professional, and there is no doubt that, in the case now under review, given that the appellant’s activity involves the constant and extensive handling of personal data, particular emphasis must be placed on the rigor and the utmost care in complying with the relevant legal provisions.” Furthermore, the National Court, in matters of personal data protection, has stated that “simple negligence or a breach of the duties imposed by law on those responsible for filing systems or for the data processing to warrant the exercise of the utmost diligence...” (Judgement of the National Court of June 29, 2001). Arguments Regarding Circumstances for Determining the Amount of the Fine. It makes the following recitals regarding the circumstances taken into account in these proceedings to determine the amount of the penalty.

C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 20/49 - Nature, severity, and duration of the violation (Article 83(2)(a) of the GDPR). Since this section of the notice of initiation sets forth the characteristics of the breach, the number of data subjects affected, and the absence of measures to prevent it, VODAFONE considers that this circumstance cannot be taken into account as an aggravating factor, since it actually constitutes the core or description of the violation committed. In this regard, we reiterate the confusion present in the arguments of the respondent. According to the Fine Guidelines, the circumstances described in subparagraphs (a), (b), and (g) of Article 83(2) of the GDPR are not Recital 10 considers “aggravating factors,” but rather circumstances that allow for determining the initial amount of the penalty (to which aggravating or mitigating factors may then be applied if they apply).

applies Art. 83(2), Art. 83(2)(a)

In fact, it would make no sense to consider the general aspects of the infringement (such as the number of affected customers, the presence of intent or negligence, or the categories of data affected) as aggravating factors, since these circumstances already provide an overall picture of the scale and severity of the violation for the purpose of determining the amount of the fine. And, at that point, the fine should be adjusted accordingly if aggravating or mitigating circumstances exist. For this reason, the circumstance referred to in Article 83(2)(a) of the GDPR is described in these proceedings in the terms set forth in this proposal, outlining the main factors at play that make it possible to determine the initial amount of the penalty. This is expressly established in the Guidelines on Fines: “(46) The EDPB considers that the calculation of administrative fines should begin from a harmonized starting point.²⁰ This starting point constitutes the basis for the subsequent calculation, in which all circumstances of the case are taken into account and weighed, resulting in the final amount of the fine to be imposed on the controller or processor.”

applies Art. 83(2)(a)

“(48) The EDPB considers that three elements constitute the starting point for the subsequent calculation: the categorization of infringements according to their nature pursuant to Article 83(4) to (6) of the GDPR, the gravity of the infringement (as explained in Section 4.2), and the company’s of the enterprise as a relevant factor to be taken into account with a view to imposing an effective, dissuasive, and proportionate fine, in accordance with Article 83(1) of the GDPR. These are described in Chapters 4.1, 4.2, Chapters 4.1, 4.2, and 4.3 are as follows: - 4.1. Reference to the limits established in paragraphs 4, 5, and 6 of Article 83(2) of the GDPR. Maximum limits and criteria for turnover C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 21/49 - 4.2. Determination of the severity of the infringement, which includes: o 4.2.1 — Nature, gravity, and duration of the infringement (Art. 83.2.a) o 4.2.2 — Whether the infringement was intentional or negligent (Art. 83.2.b) o 4.2.3 — Categories of data affected (Art. 83.2.g) Thus, it cannot be considered that in assessing these circumstances, an “aggravating factor” is being applied or, in general, that liability is being increased, but rather that the initial amount of the fine is being determined, in light of the criteria established in the Guidelines on Fines - Intent or negligence in the violation (Article 83.2.b).

applies Art. 83(1), Art. 83(2), Art. 83(4), Art. 83

Recital. VODAFONE argues in this section that negligence cannot be determined on the basis that a processor has not adopted the security measures referred to in the Initial Agreement. It then lists the measures adopted that would demonstrate the exercise of the required in this regard: (…) We have already ruled on all of them, except for one. VODAFONE argues (…). With regard to the ISO 27001 standard, it should first be noted that the mere possession of a certification of compliance with the ISO 27001 standard does not imply adequate compliance with data protection regulations. It is a standard for compliance with information security management regulations, which does not imply a management approach aimed at guaranteeing the rights and freedoms of data subjects, but rather on the security of information within an organization. Furthermore, this cannot negate the fact that the breach of confidentiality ultimately occurred, which is not mitigated by possession of the standard’s certificate.

In contrast, ISO 27701 is an international standard that provides a framework for information privacy management, expanding upon the ISO 27001 standard on information security management systems. It functions as an information privacy management system and helps organizations comply with regulations such as the GDPR. Regarding this allegation, on the one hand, VODAFONE does not provide any proof of the alleged certification. Furthermore, it should be noted that the breach did not occur due to the operation of the application itself, but rather due to the improper configuration of access rights established by the processor. In any case, the breach ultimately occurred, so it is not it is not possible to take this certification (which, moreover, is unsubstantiated) into account. - The categories of data affected (Art. 83(2)(g) GDPR). VODAFONE’s claim contains two assertions. First, that neither the first and last names nor the email addresses are personal data C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 22/49 that, by its nature, is “particularly sensitive in relation to fundamental rights and freedoms.”

applies Art. 83(2)(g)

On the other hand, that, in any case, out of the total number of data subjects affected ((...)), there were 13,020 cases in which the first and last names were affected. Consequently, there were 46,200 cases (the majority) in which only the email address was affected. As explained above, the type of data affected is a factor that may be taken into account—not as an aggravating or mitigating circumstance—but for the determination of the initial amount of the penalty. For these purposes, the corresponding legal basis justifying the amount of the fine for the violation of Article 5.1.f) details the types of data affected by the violation. - Previous violations committed by the same entity (Article 83.2.e) of the GDPR). VODAFONE points out that the two prior enforcement proceedings against VODAFONE cited in the decision to initiate proceedings to apply the The aggravating factor of recurrence would not be valid for these purposes.

applies Art. 5, Art. 83

It asserts that the previous incidents constituted isolated errors very different from the widespread breach analyzed in this proceeding. In this regard, the respondent considers that “the principle of recidivism requires, for its legitimate application, that the prior violations be of the same nature or have an objective connection, and that there be evidence of continuous or repeated conduct, rather than merely isolated incidents over time.” An analysis of the precedents reveals that they were as follows: o PS/00538/2021. VODAFONE was sanctioned for violating Articles 5.1.f) and 32 of the GDPR. With regard to the first of these articles, it was established that VODAFONE disclosed the complainant’s telephone number to a third party, thereby allowing that party to access certain personal data belonging to the complainant. Additionally, regarding Article 32, the proceedings established that there were no adequate security measures in place in the procedures for assigning phone numbers to customers. or PS/00164/2022.

applies Art. 5, Art. 32

VODAFONE is also sanctioned under the same two articles. This enterprise disclosed information about the complainant to a third party, thereby allowing that third party access to the complainant’s personal data. The decision found a breach of confidentiality (Art. 5.1.f) as well as a lack of security measures. In both proceedings, VODAFONE acknowledged its responsibility for the facts. From the outset, it was clear that the sanctions were imposed precisely for the same violations as in the present enforcement proceeding: a breach of the principle of confidentiality under Article 5.1.f) and a lack of security measures under Article 32 of the GDPR. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 23/49 Having analyzed the aforementioned EDPB Fine Guidelines, it specifically examines this aggravating factor. It reviews the two circumstances to be taken into account: o The time period during which the violations occurred.

applies Art. 5, Art. 32

The Guide does not specify maximum time periods but establishes the principle that the more recent the violations, the more relevant they are. In this case, the violations in question were penalized in the years 2021– 2022, which does not allow us to conclude that they are too distant in the past. o Nature of the violations. Paragraph 88 of the Guidelines states that: “Although all prior violations may provide an indication of the general attitude of the controller or processor with respect to compliance with the GDPR, violations involving the same subject matter should be given greater weight, as they are more closely related to the violation currently under investigation.” This provision would be fully met in this case, since the precedents relate to the principle of confidentiality and security measures. In light of these circumstances, this Agency considers it important that the penalties imposed be already final under administrative proceedings.

This is undoubtedly the case here, since, by invoking the reductions in the amount established in Article 85 of Law 39/2015, VODAFONE acknowledged its liability in both proceedings. - The offender’s connection to the processing of personal data (Article 76.2.b) of the LOPDGDD). VODAFONE disagrees with the application of the (this time, indeed) aggravating factor taken into consideration. This is for the same reasons as those stated in the argument regarding the amount of the penalty for the violation of Article 28. Therefore, we refer to that response, as the grounds for rejection expressed therein are fully applicable to this violation. - Other circumstances to be taken into account. VODAFONE believes that the circumstance provided for in Article 83(2) c) of the GDPR should be taken into account as a mitigating factor: “any measures taken by the controller or processor to mitigate the damage suffered by the data subjects.”

applies Art. 83(2), Art. 28 , Law 39/2015 Art. 85, LOPDGDD Art. 76

It asserts that ***ENTERPRISE.1 and VODAFONE adopted measures aimed at mitigating the effects of the infringement and, thereby, the potential damages that the data subjects might have suffered. With regard to this potential mitigating factor, paragraphs 75–76 of the Fine Guidelines state the following: “The adoption of appropriate measures to mitigate the damages suffered by the data subjects may be considered a mitigating factor that reduces the amount of the fine.” (point 75) C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 24/49 Measures implemented voluntarily before the controller or processor becomes aware of the initiation of the supervisory authority’s investigation are more likely to be considered a mitigating factor.” (point 76) With regard to this argument, it is necessary to analyze the wording of the potential mitigating factor, both in the GDPR and in the Guidelines on Fines.

Reference is made to the adoption of measures to “mitigate the damage suffered by the data subjects.” In contrast, VODAFONE emphasizes measures “to maintain service provision and prevent future incidents.” However laudable such action may be, it cannot be concluded that the prevention of future incidents mitigates or alleviates the harm resulting from the loss of control over their personal data. THIRD: Violation of Article 32 of the GDPR Regarding the violation of this article, VODAFONE structures its arguments into four sections Alleged Violation in the Notice of Proceedings Although this is an introductory section of its arguments, at the end of it, VODAFONE states that “if Articles 5(1)(f) and 32 of the GDPR (which is not the case), we would be dealing with a single violation, and the alleged lack of appropriate technical and organizational measures should be understood as falling under, as a means of commission, the violation of the principle of integrity and confidentiality.”

applies Art. 5(1)(f), Art. 32

Regarding this point, it must be noted that, as early as the decision to initiate proceedings, the distinction between the charges for both violations has been made clear. Thus, in the violation of Article 5.1(f) (principle of confidentiality), the sanction is imposed because the absence or inadequacy of certain measures produced a result, namely the loss of confidentiality of the personal data. That is, the measures were directly related to that loss. By contrast, the violation of article 32 is penalized due to the lack of basic security measures in the processing, even if these measures were not the cause of the loss. The occurrence of a result is not required; rather, the obligation under Article 32 is characterized as an “obligation of means.” The absence of security measures constitutes a risk to rights and freedoms, and must be penalized under that article of the GDPR. In fact, specific basic measures are mentioned that were not adopted and that were unrelated to the breach that occurred.

applies Art. 5, Art. 32

This was already indicated in the agreement to initiate proceedings. In the charge under Article 5.1.f): “In addition to the foregoing, both the breach notification submitted by the respondent and the information and documentation provided during the preliminary investigation proceedings, it has become evident that the technical and organizational measures were insufficient, which allowed for the confidentiality of the personal data being processed to be compromised.” And in the charge under Article 32: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 25/49 “It is important to note that for the obligation set forth in Article 32 to be considered breached, it is not necessary for a data breach of personal data to occur or for unauthorized access to the data to take place. The breach can be deemed to have occurred from the moment adequate security measures commensurate with the risk have not been adopted, which implies a situation of structural vulnerability in the processing.

applies Art. 5, Art. 32

Therefore, the absence or insufficiency of technical and organizational measures proportional to the risk constitutes in and of itself a violation of Article 32, and is independent of any breach that may have occurred.” Security measures challenged in the initiation decision. absence is highlighted in these proceedings. First, the lack of control over the geographic origin of the connections. It indicates that the attack originated in the United States, where the processor ***ENTERPRISE.1 is headquartered. Thus, such control would not have been effective. In this regard, we refer to what has just been clarified regarding the breach of the obligation to establish security measures, as provided for in Article 32. Regardless of the origin of the attack in this data breach, the fact remains that this measure was not in place. (As the respondent implicitly acknowledges in making this complaint.)

applies Art. 32

This control allows for the rejection of connections that clearly do not correspond to legitimate access to applications and systems, especially considering that many cyberattacks originate from countries with no connection whatsoever to the legitimate source of the connections. The absence of this measure poses a high risk that can be easily avoided by implementing it. And the fact is that VODAFONE did not have it in place. Second, it asserts that, with regard to the expiration of passwords for access, this was indeed established, referring to the corresponding clause in the data processing agreement. Indeed, in the data processing agreement, under the section titled “Management of Identification and Access,” the provider is required to establish a 90-day expiration period for passwords. In this regard, it must first be clarified that the data processing agreement cannot be considered validly entered into until a date after the breach on September 6, 2024.

This issue, as previously stated, is the subject of a charge for violation of Article 28 of the GDPR. When the breach occurred, the agreement could not be considered in force. Only on this basis can the claim be rejected However, in addition, VODAFONE’s response to the AEPD inspector includes the measure establishing an expiration period for passwords among the measures to be implemented following the breach, which confirms that it had not been in place prior to the breach. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 26/49 Liability of the processor. This section notes that the processor deviated from the instructions provided by VODAFONE. This relates to two specific aspects. First, the password expiration policy, on which we have already ruled. The second is the failure to remove from the domain controller those Users who no longer need access to the application. Regarding the latter, it is noted that the measure would be included in the data processing agreement (section 6.4).

applies Art. 28

However, this is subject to two important conditions, which have already been extensively discussed. First, the data processing agreement could not be considered validly entered into at the time the breach occurred. And second, that this would not preclude VODAFONE’s liability, since it has not been proven that the processor processed the personal data for its own purpose. Therefore, the argument must be dismissed. Absence of fault. VODAFONE considers that the charge would violate the principle of culpability, and refers to the corresponding argument made in relation to Article 5.1.f). We also refer to our response to that argument. Circumstances for determining the amount. It argues regarding the “aggravating factors” that were allegedly taken into account in the proceedings, and proposes mitigating factors to reduce the amount. - Nature, gravity, and duration of the violation (Article 83(2)(a) of the GDPR).

applies Art. 83(2)(a), Art. 5

VODAFONE considers that under no circumstances would the violation have “systemic implications”—that is, implications that could be extrapolated to other data subjects—but rather that it stems from specific events caused by an incident experienced by a processor. It should be noted that the initial agreement in no way makes any extrapolation, nor does it indicate that systemic deficiencies are involved. However, when determining the severity and scope of the infringement, it takes into consideration that the infringement (…). This factor is taken into account when determining the amount of the fine, but no extrapolation is made in relation to other data subjects or groups. - Degree of intent or negligence in the violation (Article 83(2)(b) of the GDPR). Here, VODAFONE raises two objections regarding the fact that negligence was considered serious. First, the security measures whose absence is alleged were either already in place or could not be considered basic.

applies Art. 83(2)(b)

It refers to the arguments already presented. Similarly, we must refer to what has already been responded to previously. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 27/49 Second, contrary to what is asserted in this regard in the decision to initiate proceedings, VODAFONE did carry out audit and control activities (those already mentioned on 12/22/2022 and 03/30/2023). In this regard, we should also refer to the response to the allegation that these activities were carried out. As noted, these are documents that do not detail the methodology or working procedure; they merely list a series of principles and objectives, without , and which listed as already implemented measures that were later found not to have been implemented. Thus, the conclusion remains valid that the controller merely carried out a formal compliance check on the processor, without detecting the problems that existed. - Any prior violations committed by the offender.

VODAFONE makes the same argument as in Article 5.1.f), to which we refer for our response. That response is valid for both that article and this article 32, since the precedents cited covered both violations. IV Arguments Presented in Response to the Proposed Resolution Since the brief of arguments regarding the proposed resolution largely reiterates those already set forth in the arguments concerning the decision to initiate proceedings, we refer in general to the response already provided, without prejudice to certain observations and adjustments set forth below. FIRST: Violation of Article 28 of the GDPR VODAFONE reiterates in its statement of defense that it has not infringed Article 28 of the GDPR: In response, we reiterate that, according to the documentation and arguments submitted by the defendant, there is evidence of a contract signed on September 6, 2024, and that it includes a reference stating that it entered into force on December 22, 2022.

applies Art. 5, Art. 28, Art. 32

However, the only evidence of the contract’s execution would be the signature (which guarantees the parties’ participation, knowledge, and consent) by the parties to the contract. Thus, VODAFONE has not proven that the contract was validly entered into prior to the date of signature recorded in the documentation on file, namely, December 22, 2022. Regarding the 20% reduction, to which VODAFONE also refers, we note that the reduction in the amount initially stated in the initial agreement was due to the following: “Since the initial agreement cited the particular severity of the fact that the ID number had been compromised, when in reality this is not the case, the amount of the penalty for the violation of Article 28 of the GDPR is reduced, as explained below, in the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 28/49 corresponding legal basis for this proposal (Section XIII “Proposed Penalty for Non-Compliance with Article 28 of the GDPR”).

applies Art. 28

It is unclear what connection is implied, upon reading the arguments, between the invalidity of the data processing agreement and the 20% reduction in the fine on the grounds that the ID number was not affected by the data breach. I. The data processing agreement was in effect on the date of the incident VODAFONE states that “the data processing agreement existed and was binding on the parties as early as December 2022. The document titled ‘Service Agreement’ simply set forth in writing the agreement reached between VODAFONE and ***ENTERPRISE.1, which had been binding on them since December 27, 2022.” (…) “Thus, regardless of the date the written document was signed, the existence of the data processing agreement under the terms required by Article 28.3 of the GDPR, prior to the commencement of processing operations, is substantiated in the record: a) On page 60, there is an email from A.A.A., the responsible employee at ***ENTERPRISE.1, addressed to several corporate email addresses of VODAFONE employees, including DPO-SPAIN@VODAFONE.es (…) b) On page 94 is a risk analysis dated December 22, 2022, based on the VODAFONE Group’s minimum security requirements, which, as a reminder, ENTERPRISE.1 committed to complying with as of December 27, 2022. c) On page 174 of this file is the security analysis conducted by VODAFONE following the December 2022 risk analysis, in which the measures identified as partially compliant (“Partially in place”) were tracked to review their implementation by ***ENTERPRISE.1.

applies Art. 28

As can be seen, VODAFONE’s arguments substantially mirror those already presented in response to the notice of initiation, to which we refer. We would simply like to point out that, according to the case file, the date of signature of the data processing agreement was September 4, 2024—that is, 1 year and 9 months after the agreement reached that VODAFONE cites (December 2022). A period during which, had no agreement been reached with the processor, the processing of personal data that had taken place would have lacked legal basis. In this regard, the signing of a data processing agreement—when, in practice, such processing is actually being carried out by a processor—cannot be subject to the discretion of the controller in deciding when to formalize it; rather, it must precede the actual performance of the contract because, precisely, this performance is carried out in accordance with the terms of the contract.

And, for this reason, it provides a guarantee both for the controller—who has clearly set forth the instructions that the processor must follow in performing the data processing agreement—and for the processor themselves—who can demonstrate, in accordance with the instructions received, that they have complied with the terms of the agreement. a VODAFONE provides an email, in English, sent by someone who claims to be a data controller at ***ENTERPRISE.1 addressed to several employees at C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 29/49 VODAFONE, as well as to its DPO, regarding an incident. The date of the email is 11/20/2023. Part of the email is reproduced below due to its relevance (unofficial translation): b “Subject: Confidential/Personal Data Issue at ***ENTERPRISE.1 c “I would like to update you on an incident that has recently come to light . d e ***ENTERPRISE.1 became aware of allegations of unauthorized access, along with screenshots of allegedly compromised data, which were shared online.

Two sample data files were also published online by the threat actor. We immediately initiated a response to the incident and began an investigation. 0 (…) f Although the investigation is still ongoing, we have no reason to believe that the issue affects your network services or extends beyond the identified third-party services.” 0 (…) 1 “Thank you for your patience. We will share more information as it becomes relevant. Please do not hesitate to contact us.” 2 In light of the email’s content, it appears to be a notification to VODAFONE regarding a data incident/breach suffered by ***ENTERPRISE.1, pursuant to Article 34.1 of the GDPR, “where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the breach to the data subject without undue delay,” ,” and to which reference was made in the first Background section.

applies Art. 34

Furthermore, VODAFONE states regarding the aforementioned email that “in this email, the employee of ***ENTERPRISE.1 informed this party’s employees, including its DPO, of a security breach and its impact.” The email in question cannot be considered proof that the date of the service agreement was December 27, 2022. With regard to the risk analysis dated December 22, 2022, based on the minimum security requirements of the Vodafone Group and the aforementioned security analysis, we refer to what has already been stated in the proposed resolution on this matter. Notwithstanding the foregoing, and given that the actual signing of the contract has been duly substantiated, the AEPD views this measure favorably and takes it into account in determining the amount of the fine imposed for the violation of Article 28 of the GDPR. SECOND: Infringement of Article 5.1.f) of the GDPR C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 30/49 VODAFONE expresses its disagreement, as it considers that the liability arising from the loss of data confidentiality does not rest with VODAFONE In support of its claim, VODAFONE submits Document No. 1, titled “ENCRYPTION GUIDELINES- ***ENTERPRISE.2,” an unsigned document in English dated June 1, 2023, a portion of which is reproduced below due to its relevance (unofficial translation): OVERVIEW “Cryptographic controls are applied throughout the ***ENTERPRISE.2 ‘stack’ to provide significant security.

applies Art. 5, Art. 28

Many of these controls are complex to implement or audit, and subtle errors can lead to catastrophic failures. This document provides best practices to minimize the risk at ***ENTERPRISE.2 and guide employees in making secure decisions with ease.” 2. SCOPE “These guidelines apply to all team members, contractors, and vendors. All team members are expected to understand and apply the guidelines.” The aforementioned document would establish guidelines for making secure decisions, but at no point does it mention that the data pertaining to VODAFONE is encrypted. VODAFONE again refers to two analyses conducted by VODAFONE’s information security team, which were addressed in the proposed resolution and referred to therein. It should also be noted that the alleged encryption of the information that VODAFONE seeks to assert is inconsistent with the fact that the data exfiltrated during the attack was for sale on the internet, which demonstrates, in our view, that the confidentiality of the data was compromised.

VODAFONE reiterates that the data processing agreement had been in effect since December 27, 2022, and that said agreement included detailed information on security measures, compliance with which by the data processor would have prevented the incident. Regarding the validity of the contract and the potential liability of the processor, we refer to our previous statements. However, in determining the penalty, we take into account the fact that the data processing agreement, which included technical and organizational measures designed to safeguard the confidentiality of the data, was formalized, albeit after the incident occurred. VODAFONE reiterates that its conduct does not involve any fault whatsoever, neither by willful misconduct nor by negligence, and therefore the imposition of a penalty would not be warranted; furthermore, it acted with the due diligence required of it. In this regard, we highlight what was already indicated in the proposed resolution: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 31/49 In any case, with regard to the principle of culpability, the Supreme Court ruling of October 17, 2007 (Case No. 63/2006) is fully applicable to this case, which, after noting that entities whose activities involve the continuous processing of customer and third party data must observe an adequate level of diligence, states: “[...] the Supreme Court has consistently held that negligence exists whenever a legal duty of care is disregarded; that is, when the offender fails to act with the required diligence.

And in assessing the degree of diligence, special consideration must be given to whether or not the party in question acts professionally, and there is no doubt that, in the case now under review, since the appellant’s activity involves the constant and extensive handling of personal data, there must be an emphasis on rigor and the utmost care to comply with the relevant legal provisions.” Furthermore, the National Court, in matters of personal data protection, has stated that “simple negligence or failure to comply with the duties imposed by law on persons responsible for filing systems or data processing is sufficient to require the “Under these circumstances, this party considers that the fact that particularly sensitive data as the national ID number affects the nature and categories of the processing, which are key elements for quantifying a data protection penalty. For this reason, and given that the Agency reduced the penalty for the violation of Article 28 of the GDPR from 250,000 euros to 200,000 euros (i.e., a 20% reduction), it is appropriate to also apply a reduction to the penalty corresponding to the violation of Article 5.1(f) of the GDPR.”

applies Art. 5, Art. 28

In this regard, it should be noted that the section referring to the categories of data affected by the infringement (Article 83(2)(g) of the GDPR) states: the leakage of basic personal data such as email addresses, associated with the corresponding first and last names. In other words, no reference is made to the national identification number (DNI), and therefore this claim must be dismissed. THIRD: Violation of Article 32 of the GDPR VODAFONE asserts that it has not violated Article 32 of the GDPR and bases this on arguments that reiterate those already raised in connection with the agreement to initiate the present proceedings, to which a response was already provided in the proposed resolution issued. That said, it again asserts that liability for the violation of Article 32 of the GDPR would not fall on VODAFONE but on the processor. As we have noted, this argument has already been duly addressed in the draft resolution phase.

applies Art. 83(2)(g), Art. 32

However, given that the measures whose absence is C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 32/49 are included in the data processing agreement—although this agency acknowledges their legal validity only after the events that are the subject of these proceedings—this fact is taken into account when assessing the penalty to be imposed for the commission of this violation. The remaining arguments raised regarding this violation have already been duly addressed in the proposed resolution, to which we refer. IV Breach of Obligation. Integrity and Confidentiality Article 5.1(f) of the GDPR 1. Regulatory Reference and Breach Occurred Article 5.1(f) of the GDPR states: “1. Personal data shall be: (…) (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, through the implementation of appropriate technical or organizational measures (“integrity and confidentiality”).”

applies Art. 5

In the present case, a data breach involving personal data has occurred. According to the available information, including the notification of this breach to the AEPD by VODAFONE regarding said breach, the information obtained during the preliminary investigation conducted, and in accordance with the established facts of this decision, it is evident that on November 20, 2023, a VODAFONE supplier (***ENTERPRISE.1) reported a security incident that affected a file containing VODAFONE customer data. The affected customers (…) were able to download a file containing VODAFONE customer data. The person in charge stated that: “***ENTERPRISE.1 is a VODAFONE supplier (…). To provide these services, ***ENTERPRISE.1 (…). A copy of the email sent to VODAFONE on November 20, 2023, is attached. According to the communication sent by ***ENTERPRISE.1 to VODAFONE, (…). The fourth established fact details the type and number of affected individuals, which can be summarized as the first and last names of a total of (…) customers The source of the breach was unauthorized access, using legitimate credentials, to one of the systems used by the provider to provide services to the data controller, and the details are contained in the fifth established fact: The description of the cause of the breach itself reveals deficiencies regarding the technical and organizational measures that led to it: the tool ENTERPRISE.2 (…).

These deficiencies are evident in VODAFONE’s response to the request for information from this Agency’s inspection. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 33/49 Therefore, with regard to the lack of technical and organizational measures that led to the loss of confidentiality of the personal data of VODAFONE customers, the following observations are made: (…) Their absence must be considered a failure to implement a basic measure to protect the integrity and confidentiality of personal data - (…) In addition to the above, both the breach notification submitted by the respondent and the information and documentation provided during the preliminary investigation, the inadequacy of the technical and organizational measures has become evident, which allowed the confidentiality of the personal data being processed to be compromised. Thus, in VODAFONE’s response to this Agency’s request, it cites (…) as one of the subsequent measures.

Finally, it must be noted that VODAFONE, as the controller, has provided no information regarding the potential oversight measures it would implement to ensure that its processor complies with the required measures. Although the data processing agreement provides for the possibility that the controller may conduct audits of the processor’s compliance, the controller has provided no information regarding this aspect; thus, the controller merely formally imposed the obligations without supervising whether they were actually being met. All of these factors provide sufficient evidence to conclude that, at the time the breach occurred, the respondent had not implemented appropriate technical or organizational measures in place to ensure adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage. Articles 5(2) and 24 of the GDPR impose general obligations of accountability and compliance on the controller of personal data.

applies Art. 5(2), Art. 24

These provisions require the controller to adopt appropriate measures aimed at preventing possible violations of the rules established by the GDPR, in order to guarantee the right to data protection Therefore, in accordance with the established facts of this decision, it is considered that the known facts constitute an infringement attributable to VODAFONE for violating Article 5.1.f) of the GDPR, as transcribed above. V Classification of the violation of Article 5(1)(f) of the GDPR and determination for purposes of the statute of limitations C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 34/49 Article 83.5 of the GDPR classifies as an administrative violation the breach of the following articles, which shall be penalized, in accordance with paragraph 2, with administrative fines of up to 20,000,000 EUR or, in the case of an enterprise, an amount equivalent to a maximum of 4% of the total annual global turnover for the preceding financial year, whichever is higher: “a) the basic principles governing processing, including the conditions for consent as set forth in Articles 5, 6, 7, and 9;” For its part, article 71 of the LOPDGDD, “Violations,” states that: “Acts and conduct referred to in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law.”

applies Art. 5(1)(f), Art. 5, Art. 83 , LOPDGDD Art. 5, LOPDGDD Art. 6, LOPDGDD Art. 7, LOPDGDD Art. 9, LOPDGDD Art. 71

For the sole purpose of the statute of limitations, Article 72.1 of the LOPDGDD provides as follows: “Pursuant to Article 83(5) of Regulation (EU) 2016/679, , infringements that constitute a substantial violation of the articles mentioned therein—and, in particular, the following—shall be considered very serious and shall be subject to a three-year statute of limitations: a) The processing of personal data in violation of the principles and safeguards set forth in Article 5 of Regulation (EU) 2016/679.” VI Penalty for noncompliance with Article 5.1.f) of the GDPR In order to determine the administrative fine to be imposed, the provisions of Articles 83(1) and 83(2) of the GDPR must be observed, which state: “1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this article for the infringements of this Regulation referred to in paragraphs 4, 9, and 6 is, in each individual case, effective, proportionate, and dissuasive. 2.

applies Art. 83(1), Art. 83(2), Art. 83(5), Art. 5 , LOPDGDD Art. 72

Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or in lieu of the measures referred to in Article 58(2)(a) through (h) and (j). When deciding whether to impose an administrative fine and its amount in each individual case, due consideration shall be given to: (a) the nature, gravity, and duration of the violation, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the extent of the damages they have suffered; b) whether the violation was intentional or due to negligence; c) any measures taken by the controller or processor to mitigate the damages suffered by the data subjects; C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 35/49 d) the degree of responsibility of the controller or processor, taking into account the technical or organizational measures they have implemented pursuant to Articles 25 and 32; e) any previous violations committed by the controller or processor; f) the extent of cooperation with the supervisory authority to remedy the violation and mitigate its potential adverse effects; g) the categories of personal data affected by the breach; h) the manner in which the supervisory authority became aware of the breach, in particular whether the controller or processor notified the supervisory authority of the breach and, if so, to what extent; i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms certification mechanisms approved pursuant to Article 42, and k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the violation.”

applies Art. 58(2), Art. 58(2)(a), Art. 25, Art. 32, Art. 40, Art. 42

For its part, article 76, “Penalties and Corrective Measures,” of the LOPDGDD provides: “1. The penalties provided for in paragraphs 4, 5, and 6 of article 83 of the Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the level of the sanction set forth in paragraph 2 of the aforementioned article. 2. In accordance with the provisions of Article 83(2)(k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The ongoing nature of the violation. b) The connection between the violator’s activity and the processing of personal data. c) The profits obtained as a result of the violation. d) The possibility that the data subject’s conduct may have contributed to the commission of the violation. e) The existence of a merger by absorption occurring after the commission of the violation, which cannot be attributed to the absorbing entity. f) The impact on the rights of minors. g) Having a data protection officer, where such a position is not mandatory. h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in cases where disputes exist between them and any data subject.”

applies Art. 83(2)(k), Art. 83 , LOPDGDD Art. 76

In the present case, with regard to the seriousness of the possible violation, with particular regard to the consequences it has on those affected, a fine should be imposed, in addition to the adoption of measures, if appropriate. The fine imposed must, in each individual case, be effective, proportionate, and deterrent, in accordance with the provisions of Article 83(1) of the GDPR. It is hereby decided, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 36/49 as a preliminary matter, VODAFONE’s annual revenue to be €2,909,851,000 for the year 2024. For the purposes of deciding on the imposition of an administrative fine and its amount, in accordance with the established facts, it is considered appropriate to determine the penalty to be imposed in accordance with the following circumstances, as set forth in the provisions cited above. • The nature, gravity, and duration of the violation, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the extent of the damages they have suffered (Article 83(2)(a) of the GDPR).

applies Art. 83(1), Art. 83(2)(a)

With regard to severity, it should be noted that this is a widespread data breach involving VODAFONE customer data, resulting from a cyberattack that allowed for the exfiltration and publication of the compromised filing systems compromised files, including enterprise customers, self-employed individuals, and private individuals. In this regard, the number of data subjects affected, as detailed in the background of this proposed resolution, amounts to a total of (...) affected individuals. • Intent/Negligence in the violation (Article 83(2)(b) of the GDPR): serious negligence is deemed to have occurred, given Recital 83(2)(b) that the controller’s conduct reveals a serious lack of diligence, as it failed to implement the minimum operational controls required in the course of its activities. The absence of an adequate authentication system and the lack of encryption do not stem from a one-time error or an accidental circumstance, but rather from the ongoing management of the environment without addressing the risks inherent in the processing of personal data.

applies Art. 83(2)(b)

This type of structural oversight does not constitute an isolated technical failure, but rather an indicator of a systematic failure to pay attention to the most basic aspects of protection, which allows the conduct to be classified as gross negligence for the purposes of determining the penalty, distinguishing such conduct from the primary offense. • The categories of data affected by the infringement (Article 83(2)(g) of the GDPR). The leak of basic personal data such as email addresses, associated with the corresponding first and last names. Likewise, the following factors are considered as aggravating circumstances for determining the penalty: • Any prior infringement committed by the controller or processor (Article 83(2)(e) of the GDPR): penalty proceedings PS/00164/2022 and PS/00538/2021 (both for violations of Article 5.1(f) of the GDPR) The first of these (PS/00164/2022) sanctions VODAFONE for violating the principle of confidentiality of personal data by disclosing to a third party information about another customer of the operator (name, national ID number, and phone number).

applies Art. 83(2)(e), Art. 83(2)(g), Art. 5

The second (PS/00538/2021) also imposes a penalty for the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 37/49 same violation, by assigning a telephone number that belonged to the complainant to a customer. • The link between the violator’s activity and the processing of personal data (Article 76.2(b) of the LOPDGDD). On On the one hand, the offender’s main activity involves offering services to the general public and attracting a large number of customers who are natural persons. Therefore, the ongoing processing of their customers’ personal data is an essential part of their activity. On the other hand, the systems targeted by the attack in this case relate to the marketing of the operator’s services; thus, they are also specifically linked to the routine processing of personal data. In addition, the following aggravating factor is considered a mitigating circumstance pursuant to Article 83(2) of the GDPR: - Any measures taken by the controller or processor to mitigate the damage suffered by the data subjects (Article 83(2)(c) of the GDPR): it is established in this case that VODAFONE’s contract for the processing of personal data—although legally valid only after the events occurred—includes technical and organizational measures designed to ensure the confidentiality of the data being processed.

applies Art. 83(2), Art. 83(2)(c) , LOPDGDD Art. 76

A balance of the circumstances set forth in Article 83(2) of the GDPR and Article 76(2) of the LOPDGDD, with respect to the violation committed by breaching the provisions of Article 5(1)(f) of the GDPR, allows for the imposition of an administrative fine of FIVE HUNDRED THOUSAND EUROS (€500,000). VII Article 32 of the GDPR Failure to comply with an obligation. Security of processing Article 32 of the GDPR stipulates the following: “1. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons , the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, which, where applicable, shall include, among others: a) the pseudonymisation and encryption of personal data; b) the ability to ensure the confidentiality, integrity, availability, and resilience of processing systems and services; c) the ability to restore the availability of and access to personal data promptly in the event of a physical or technical incident; d) a process for regularly verifying, evaluating, and assessing the effectiveness of the technical and organizational measures to ensure the security of the processing. 2.

applies Art. 5(1)(f), Art. 83(2), Art. 32 , LOPDGDD Art. 76(2)

When assessing the adequacy of the level of security, particular consideration shall be given to the risks posed by the processing of personal data, in particular as a consequence of the accidental or unlawful destruction, loss, or alteration of data C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 38/49 transmitted, stored, or otherwise processed, or the unauthorized disclosure or access to such personal data. 3. Adherence to a code of conduct approved pursuant to Article 40 or to a certification mechanism approved pursuant to Article 42 may serve as evidence of compliance with the requirements set forth in paragraph 1 of this article. 4. The controller and the processor shall take measures to ensure that any person acting under the authority of the controller or the processor and having access to personal data may process such data only on instructions from the controller, unless required to do so under the law of the Union or of the Member States.”

applies Art. 40, Art. 42

The documentation in the case file provides evidence of a violation of Article 32(1) of the GDPR, due to the absence of security measures in the processing of VODAFONE customers’ personal data (…)” It should be noted that the GDPR, in the aforementioned provision, does not establish a list of security measures that are applicable based on the data being processed, but rather stipulates that the controller and the processor shall implement technical and organizational measures appropriate to the risk posed by the processing, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, and the risks—in terms of likelihood and severity—to the rights and freedoms of the data subjects. Likewise, security measures must be appropriate and proportionate to the identified risk, noting that the determination of technical and organizational measures must take into account: pseudonymisation and encryption, the ability to ensure confidentiality, integrity, availability, and resilience, the ability to restore availability and access to data following an incident, and the process of verification (as distinct from auditing), evaluation, and assessment of the effectiveness of the measures.

applies Art. 32(1)

In any case, when assessing the adequacy of the security level in relation to the risk, particular consideration shall be given to the risks posed by data processing, such as resulting from the accidental or unlawful destruction, loss, or alteration of personal data transmitted, stored, or otherwise processed, or the unauthorized disclosure of or access to such data, which could cause physical, material, or non-material damage or harm. In this regard, Recital 83 of the GDPR states that: “(83) In order to maintain security and prevent the processing from infringing the provisions of this Regulation, the controller or processor must assess the risks inherent in the processing and implement measures to mitigate them, such as encryption. These measures must ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the cost of implementation in relation to the risks and the nature of the personal data to be protected.

When assessing risk in relation to data security, one must take into account the risks arising from the processing of personal data, such as the accidental or unlawful destruction, loss, or alteration of personal data C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 39/49 transmitted, stored, or otherwise processed, or the unauthorized disclosure of or access to such data, which may, in particular, result in physical, material, or non-material damages.” As Recital 39 also notes: “…Personal data must be processed in a manner that ensures adequate security and confidentiality of personal data, including to prevent unauthorized access or use of such data and the equipment used in the processing It should be noted that security measures appropriate to the risk are key to guaranteeing the fundamental right to data protection, since it is not possible to ensure that right if the confidentiality, integrity, and availability of personal data cannot be guaranteed.

To ensure these security factors, both technical and organizational measures that are appropriate are necessary. It is important to emphasize that for the obligation set forth in Article 32 to be considered breached, it is not necessary for a data breach of personal data to occur or for unauthorized access to the data to take place. The violation can be established from the moment adequate security measures have not been adopted in accordance with the risk, which implies a situation of structural vulnerability in the processing. Therefore, the absence or inadequacy of technical and organizational measures proportional to the risk constitutes in itself a violation of Article 32, and is independent of any breach that may have occurred. One of the requirements established by the GDPR for controllers and processors who carry out processing activities involving personal data is the need to conduct an information security risk assessment for the purpose of establishing security and control measures aimed at complying with the principles of protection by design and by default that guarantee the rights and freedoms of individuals.

applies Art. 32

The documentation included in the case file reveals clear deficiencies in the adoption of security measures, which are basic measures intended to protect the security of information systems. The following is a list of the main deficiencies detected through the preliminary investigative actions carried out by this Agency. (…) All of these aspects provide sufficient evidence to conclude that the respondent had not implemented appropriate technical and organizational security measures to ensure a level of security commensurate with the risk at the time of the events. Therefore, based on the available evidence, it is considered that the known facts constitute a violation, attributable to VODAFONE, for breach of the article cited above. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 40/49 VIII Classification of the violation under Article 32 of the GDPR and determination for purposes of the statute of limitations Article 83(4) of the GDPR classifies the violation of the following articles as an administrative offense; such violations shall be penalized, in accordance with paragraph 2, with administrative fines of up to 10,000,000 EUR or, in the case of an enterprise, an amount equivalent to up to 2% of the total annual global turnover for the previous fiscal year, whichever is higher: “a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 through 39, 42, and 43;” For its part, Article 71 of the LOPDGDD, titled “Infractions,” states that: “Acts and conduct referred to in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute violations.”

applies Art. 83(4), Art. 32, Art. 83 , LOPDGDD Art. 8, LOPDGDD Art. 11, LOPDGDD Art. 25, LOPDGDD Art. 71

For the sole purpose of the statute of limitations, Article 73 of the LOPDGDD establishes the following: “Pursuant to the provisions of Recital 83(4) of Regulation (EU) 2016/679, infractions that constitute a substantial breach of the articles mentioned therein, and in particular the following, shall be considered serious and shall be subject to a two-year statute of limitations: f) Failure to adopt the technical and organizational measures that are appropriate to ensure a level of security appropriate to the risk of the processing, as required by Article 32(1) of Regulation (EU) 2016/679.” IX Penalty for Noncompliance with Article 32 of the GDPR In order to determine the administrative fine to be imposed, the provisions of Articles 83(1) and 83(2) of the GDPR must be observed, as well as those of Article 76 Of the LOPDGDD, as set forth above. In the present case, considering the seriousness of the potential violation, with particular regard to the consequences it has for the data subjects, a fine should be imposed, in addition to the adoption of measures, if appropriate.

applies Art. 32(1), Art. 83(1), Art. 83(2), Art. 32 , LOPDGDD Art. 73, LOPDGDD Art. 76

The fine imposed must, in each individual case, be effective, proportionate, and deterrent, in accordance with article 83(1) of the GDPR. Accordingly, VODAFONE’s annual revenue is preliminarily estimated at 2,909,851,000 euros for the year 2024. For the purposes of deciding on the imposition of an administrative fine and its amount, based on the established facts, the penalty to be imposed must be determined in accordance with the following circumstances, as set forth in the aforementioned provisions. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 41/49 It is considered that the following circumstances exist: • The nature, gravity, and duration of the violation, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the extent of the damages they have suffered (Article 83(2)(a) of the GDPR).

applies Art. 83(1), Art. 83(2)(a)

In this case, the number of data subjects affected must be taken into consideration. It should be noted that the lack of security measures affects all customers whose data were processed by the processor. The total number of such data subjects is (...). • Intent or Negligence in the Violation (Article 83(2)(b) of the GDPR). The negligence involved in this violation should be classified as serious. This is because the missing security measures were of a basic nature ((…)). All of this, combined with the effective absence of audits of the processing carried out by the processor, as set forth in the data processing agreement, the legal validity of which the AEPD recognized after the fact. • The categories of data affected by the violation (Article 83(2)(g) of the GDPR). All of the basic data subject to processing is involved, such as email addresses, associated with the corresponding first and last names.

applies Art. 83(2)(b), Art. 83(2)(g)

Furthermore, the following factors are considered as aggravating circumstances: • Any prior infringement committed by the controller or processor (Article 83(2)(e) of the GDPR). The same precedents cited in determining the amount of the fine under Article 5.1(f), since those cases also imposed penalties for the lack of security measures in accordance with Article 32: PS/00164/2022 and PS/00538/2021. The first of these (PS/00164/2022) imposes a penalty on VODAFONE for the lack of security measures for personal data, resulting in the disclosure to a third party of data belonging to another customer of the operator (name, national ID number, and phone number). The second (PS/00538/2021) also imposes a penalty for the same violation, for assigning a telephone number that belonged to the complainant to a customer. • The link between the infringer’s activity and the processing of personal data (Article 76.2(b) of the LOPDGDD).

applies Art. 83(2)(e), Art. 5, Art. 32 , LOPDGDD Art. 76

On the one hand, the offender’s primary activity involves offering services to the general public and attracting a large number of customers who are natural persons. Therefore, the ongoing processing of its customers’ personal data is an essential part of its activity. On the other hand, the systems targeted in this case relate to the marketing of the operator’s services, and as such, they are also specifically linked to the routine processing of personal data. Furthermore, the following mitigating factor is considered pursuant to Article 83(2) of the GDPR: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 42/49 - Any measures taken by the controller or processor to mitigate the damages suffered by the data subjects (Article 83(2)(c) of the GDPR): it is established in this case that VODAFONE has adopted measures aimed at strengthening the security of the processing. Furthermore, although the data processing agreement entered into after the facts occurred and without evidence of effective implementation, the agreement provides for the conduct of periodic audits of the processing carried out by the processor A balancing of the circumstances set forth in Article 83(2) of the GDPR and Article 76(2) of the LOPDGDD, with respect to the violation committed by breaching the provisions of Article 32 of the GDPR, allows for the imposition of an administrative fine of ONE HUNDRED FIFTY THOUSAND EUROS (€150,000).

applies Art. 83(2), Art. 83(2)(c), Art. 32 , LOPDGDD Art. 76(2)

X Article 28 of the GDPR. Failure to comply. Processor The provisions regarding the processor are set forth in Article 28 of the GDPR, which stipulates the following: “1. Where processing is to be carried out on behalf of a controller, , the controller shall select only a processor that provides sufficient guarantees to implement appropriate technical and organizational measures, so that the processing complies with the requirements of this Regulation and ensures the protection of the data subject rights. 2. The processor shall not engage another processor without the prior written authorization—whether specific or general—of the controller. In the latter case, the processor shall inform the controller of any planned changes involving the engagement or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 3. Processing by the processor shall be governed by a contract or other legal act under Union or Member State law, which binds the processor to the controller and sets forth the subject matter, duration, nature, and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller.

applies Art. 28

That contract or legal act shall stipulate, in particular, that the processor: (a) shall process personal data only on documented instructions from the controller, including with regard to data transfers to a third country or an international organisation, unless required to do so under Union or Member State law applicable to the processor; in which case, the processor shall inform the controller of that legal requirement prior to processing, unless such law prohibits it for important reasons of public interest; (b) ensure that persons authorized to process personal data have undertaken to respect confidentiality or are subject to a legal obligation of confidentiality; (c) take all necessary measures in accordance with Article 32; d) comply with the conditions set forth in paragraphs 2 and 4 when engaging another processor; C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 43/49 e) assist the controller, taking into account the nature of the processing, through appropriate technical and organizational measures, whenever possible, so that the controller may fulfill its obligation to respond to requests aimed at the exercise of the data subject rights set forth in Chapter III; f) assist the controller in ensuring compliance with the obligations set forth in Articles 32 through 36, taking into account the nature of the processing and the information available to the processor; g) at the controller’s discretion, shall delete or return all personal data once the provision of processing services has ended, and shall delete any existing copies unless the storage of the personal data is required under Union or Member State law; h) make available to the controller all information necessary to demonstrate compliance with the obligations set forth in this article, as well as to enable and assist in the conduct of audits, including inspections, by the controller or another auditor authorized by the controller.

applies Art. 32

With regard to subparagraph (h) of the first paragraph, the processor shall inform the controller immediately if, in its opinion, an instruction infringes this Regulation or other data protection provisions of the Union or of the Member States. 4. Where a processor engages another processor to carry out certain processing activities on behalf of the controller, the same data protection obligations as those set forth in the contract or other legal act under Union or Member State law, the same data protection obligations as those set forth in the contract or other legal act between the controller and the processor referred to in paragraph 3, in particular the provision of sufficient guarantees that appropriate technical and organizational measures will be implemented so that the processing complies with the provisions of this Regulation. If that other processor fails to fulfill its data protection obligations, the original processor shall remain fully liable to the controller with respect to the fulfillment of the obligations of the other processor. 5.

The processor’s adherence to a code of conduct approved pursuant to Article 40 or to a certification mechanism approved pursuant to Article 42 may be used as an element to demonstrate the existence of the sufficient safeguards referred to in paragraphs 1 and 4 of this article. 6. Without prejudice to the conclusion of an individual contract between the controller and the processor, the contract or other legal act referred to in paragraphs 3 and 4 of this article may be based, in whole or in part, on the standard contractual clauses referred to in paragraphs 7 and 8 of this article, even when they form part of a certification granted to the controller or processor in accordance with Articles 42 and 43. 7. The Commission may establish standard contractual clauses for the matters referred to in paragraphs 3 and 4 of this article, in accordance with the examination procedure referred to in Article 93(2).

applies Art. 93(2), Art. 40, Art. 42, Art. 43

C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 44/49 8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraphs 3 and 4 of this article, in accordance with the consistency mechanism referred to in Article 63. 9. The contract or other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form. 10. Without prejudice to Articles 82, 83, and 84, if a processor violates this Regulation by determining the purposes and means of processing, it shall be considered the controller with respect to such processing.” Article 28 of the GDPR imposes the obligation that, in the event an entity is to carry out personal data processing operations on behalf of another entity that determines the means and purposes, a contract must be entered into that binds the processor to the controller and sets forth “the subject matter, duration, nature, and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller.”

applies Art. 28, Art. 63, Art. 82, Art. 83, Art. 84

The purpose is clear: to ensure that the fact that the processing of personal data is physically carried out by an enterprise other than the controller—but on the controller’s behalf or at its request—does not result in a compromise of compliance with GDPR obligations. In this regard, it is important to note that this entrustment may affect rights and obligations as significant as the exercise of rights by data subjects; the guarantee of the data integrity and confidentiality, and the need to establish appropriate security measures that help ensure these principles (the latter aspects being particularly relevant in this case). Therefore, article 28(3) imposes both the obligation to enter into a contract and the minimum content that it must include. With regard to the formal conclusion of the contract, it is important to refer to the provisions of paragraph 101 of Guidelines 07/2020 of the European Data Protection Board on the concepts of “controller” and “processor” in the GDPR “(101) This legal act must be in writing, and an electronic format is permitted.

applies Art. 28(3)

Therefore, agreements not formalized in writing (regardless of their comprehensiveness or effectiveness) cannot be considered sufficient to meet the requirements set forth in Article 28 of the GDPR. In order to avoid any difficulty in proving the validity of the contract or other legal act, the EDPB recommends ensuring that the necessary signatures have been included in the legal act in accordance with the provisions of applicable law (e.g., contract law).” With regard to the present proceedings, and in accordance with the established facts of this decision, a personal data breach occurred that affected the processing carried out by ***ENTERPRISE.1, in its capacity as a processor, on behalf of VODAFONE. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 45/49 With regard to the data processing agreement entered into between VODAFONE and ***ENTERPRISE.1, although it initially states that (unofficial translation from English) “(…)”, the fact is that in the section of the agreement containing the signatures of VODAFONE’s two authorized representatives of VODAFONE, the date shown in their electronic signatures is “September 4, 2024.”

applies Art. 28

It should be noted that this is in the Anglo-Saxon format (the entire document is in English) and refers to the date 9/4/2024. Even under the interpretation most favorable to VODAFONE (9/04/2024), this would be well after the occurrence of the breach, which took place on 11/20/2023. We have already seen that the regulations governing the execution of a contract for the processing of personal data require certain formalities, such as execution in writing and the signatures of the parties involved. These requirements are not met in this case. This is because on the date the data breach occurred (November 20, 2023), the contract could not be considered in force. Therefore, based on the available evidence, it is considered that the known facts constitute a violation attributable to VODAFONE, for breach of the article cited above. Classification of the violation of Article 28 of the GDPR and determination for purposes of the statute of limitations Article 83(4) of the GDPR classifies the violation of the following articles as an administrative offense; such violations shall be penalized, in accordance with paragraph 2, with administrative fines of up to 10,000,000 EUR or, in the case of an enterprise, an amount equivalent to up to 2% of the total annual for the preceding financial year, whichever is higher: “a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 through 39, 42, and 43; For its part, article 71 of the LOPDGDD, titled “Violations,” states that: “Acts and conduct referred to in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute infringements.”

applies Art. 83(4), Art. 28, Art. 83 , LOPDGDD Art. 8, LOPDGDD Art. 11, LOPDGDD Art. 25, LOPDGDD Art. 71

For the sole purpose of the statute of limitations, Article 73 of the LOPDGDD establishes the following: “Pursuant to the provisions of Recital 83(4) of Regulation (EU) 2016/679, infractions that constitute a substantial violation of the articles mentioned therein, and in particular the following: k) Entrusting data processing to a third party without first entering into a contract or other written legal instrument containing the information required by Article 28.3 of Regulation (EU) 2016/679.” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 46/49 XII Penalty for non-compliance with Article 28 of the GDPR In order to determine the administrative fine to be imposed, the provisions of Articles 83(1) and 83(2) of the GDPR must be observed, as well as Article 76 of the LOPDGDD, as already set forth in the sixth ground of this proposed resolution. In the present case, considering the seriousness of the potential violation, with particular regard to the consequences it causes for the data subjects, the imposition of a fine would be appropriate.

applies Art. 83(1), Art. 83(2), Art. 28 , LOPDGDD Art. 73, LOPDGDD Art. 76

The fine imposed must be, in each individual case, effective, proportionate, and deterrent, in accordance with the provisions of Article 83(1) of the GDPR. To ensure these principles are upheld, the turnover of VODAFONE, which is 2,909,851,000 euros for the year 2024. The maximum amount of the fine could reach 58,197,020 euros. For the purposes of deciding on the imposition of an administrative fine and its amount, based on the available evidence, it is considered appropriate to determine the penalty to be imposed in accordance with the following circumstances, as set forth in the aforementioned provisions. As a preliminary matter, it is determined that the following circumstances exist: • The nature, gravity, and duration of the violation, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the extent of the damages they have suffered (Article 83(2)(a) of the GDPR).

applies Art. 83(1), Art. 83(2)(a)

In this case, the number of data subjects affected must be taken into consideration. It must be noted that the absence of a data processing agreement prevents effective oversight of the processor’s compliance with data protection obligations and, consequently, the protection of the rights and freedoms of the data subjects. (…). • Intent/Negligence in the infringement (Article 83(2)(b) of the GDPR): the negligence must be classified as particularly serious. Indeed, there is no other way to characterize the situation of a telecommunications operator that enters into contracts with a large number of citizens—and which has been required to enter into and document its data processing agreements since May 2018—yet entrusted with services that involve the processing of personal data belonging to its customers without having entered into the appropriate data processing agreement. This is all the more true given that enterprises of this type routinely and regularly rely on outsourcing techniques, as in this case.

applies Art. 83(2)(b)

And the conclusion and validity of the data processing agreement is essential, as it sets forth the instructions from the data controller, on the basis of which the processor carries out the processing. • The categories of personal data affected by the infringement (Article 83(2)(g) of the GDPR). When assessing the absence of a data processing agreement, all basic data is involved, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 47/49 subject of the processing, such as the email address associated with the corresponding first and last names, Likewise, the following aggravating factor is considered: • The connection between the offender’s business activity and the processing of personal data (Article 76.2(b) of the LOPDGDD). On the one hand, the offender’s main activity involves offering services to the general public and attracting a large number of customers who are natural persons.

applies Art. 83(2)(g) , LOPDGDD Art. 76

Therefore, the ongoing processing of their customers’ personal data is an essential part of their activity. On the other hand, the systems targeted by the attack in this case relate to the marketing of the operator’s services; thus, they are also specifically linked to the routine processing of personal data. In addition, the following mitigating factor is considered pursuant to Article 83(2) of the GDPR: - Any measures taken by the controller or processor to mitigate the damage suffered by the data subjects (Article 83(2)(c) of the GDPR): it is established in this case that VODAFONE duly formalized the data processing agreement, albeit after the events occurred. A balance of the circumstances set forth in Article 83(2) of the GDPR and Article 76(2) of the LOPDGDD, with respect to the violation committed by breaching the provisions of Article 28 of the GDPR, allows for the initial imposition of an administrative fine of ONE HUNDRED THOUSAND EUROS (€100,000).

applies Art. 83(2), Art. 83(2)(c), Art. 28 , LOPDGDD Art. 76(2)

XIII In light of the facts set forth, it is considered appropriate to impose a penalty on the respondent for the violation of Article 28 of the GDPR, Article 32 of the GDPR, and Article 5(1)(f) of the GDPR, as defined in Article 83(4) of the GDPR and Article 83(5) of the GDPR. The penalty to be imposed is an administrative fine in the total amount of 750,000 euros (SEVEN HUNDRED AND FIFTY THOUSAND EUROS). for determining the severity of sanctions, the existence of which has been established, the Presidency of the Spanish Data Protection Agency RESOLVES: FIRST: TO IMPOSE on VODAFONE ESPAÑA, S.A.U., with Tax ID No. A80907397, for: - A violation of Article 5(1)(f) of the GDPR, as defined in Article 83(5) of the GDPR, a fine of 500,000€. - A violation of Article 32 of the GDPR, as specified in Article 83.4 of the GDPR, a fine of €150,000. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 48/49 - A violation of Article 28 of the GDPR, as specified in Article 83(4) of the GDPR, carrying a fine of 100,000 euros.

applies Art. 5(1)(f), Art. 83(4), Art. 83(5), Art. 28, Art. 32, Art. 83

The total amount of the fine is €750,000 (SEVEN HUNDRED AND FIFTY THOUSAND EUROS) SECOND: NOTIFY VODAFONE ESPAÑA, S.A.U. of this decision. THIRD: This decision shall become enforceable once the deadline for filing the optional appeal for reconsideration has expired (one month from the day following the notification of this decision), provided that the data subject has not exercised this right. The party subject to the penalty is hereby notified that they must pay the imposed penalty once this decision becomes enforceable, in accordance with the provisions of Art. 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in Art. 68 of the General Collection Regulation, approved by Royal Decree 939/2005, of July 29, in conjunction with Article 62 of Law 58/2003, of December 17, by making a deposit, indicating the taxpayer identification number (NIF) of the person subject to the penalty and the case number appearing at the top of this document, into the restricted account No. IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX), opened in the name of the Spanish Data Protection Agency at the bank CAIXABANK, S.A. Otherwise, the amount will be collected through enforcement proceedings.

applies Art. 68 , Law 39/2015 Art. 98, Law 58/2003 Art. 62

Once the notice has been received and becomes enforceable, if the effective date falls between the 1st and 15th of each month, inclusive, the deadline for making the voluntary payment will be the 20th of the following month or the next business day thereafter; and if it falls between the 16th and the last day of each month, inclusive, the payment deadline shall be until the 5th of the second following month or the next business day thereafter. In accordance with the provisions of Article 76.4 of the LOPDGDD and given that the amount of the fine imposed exceeds one million euros, the information identifying the offender, the violation committed, and the amount of the fine shall be published in the Official State Gazette. In accordance with the provisions of Article 50 of the LOPDGDD, this Resolution shall be made public. Publication shall take place once it has been notified to the data subjects.

applies LOPDGDD Art. 76, LOPDGDD Art. 50

Against this resolution, which concludes the administrative proceedings pursuant to Article 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the data subjects may, at their discretion, file a motion for reconsideration with the Presidency of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative-litigious appeal with the Administrative-Litigious Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, governing the Administrative Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 49/49 Finally, it is noted that, in accordance with the provisions of Article 90.3(a) of the LPACAP, a final administrative decision may be provisionally suspended if the data subject expresses their intention to file a contentious-administrative appeal.

applies Art. 46, Art. 90 , LOPDGDD Art. 48, Law 29/1998 Art. 25

If this is the case, the data subject must formally notify the Spanish Data Protection Agency of this fact by submitting a written notice addressed to the Spanish Data Protection Agency through the Agency’s Electronic Registry web/, or through any of the other registries provided for in Art. 16.4 of the aforementioned Law 39/2015, of October 1. The data subject must also submit to the Agency the documentation proving that the contentious-administrative appeal has been effectively filed. If the Agency is not made aware of the filing of the contentious-administrative appeal within two months from the day following the notification of this decision, it will terminate the provisional suspension. 938-101025 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency 28001 – Madrid 6 sedeaepd.gob.es

applies Law 39/2015 Art. 16