Vodafone España, S.A.U.: Insufficient legal basis for data processing

The Spanish DPA (AEPD) has fined Vodafone España, S.A.U. EUR 40,000. An individual had filed a complaint with the DPA against Vodafone for debiting his bank account in May 2020 for a Vodafone telephone line whose owner was not him but his ex-partner. As it turned out, the complainant's ex-partner had concluded a contract with Vodafone in his name. She stated that she was authorized to do so, but did not provide any proof of this. The DPA found that Vodafone had unlawfully processed the complainant's data. Indeed, compliance with the principle of lawfulness in the processing of third party data requires that the controller is able to prove lawfulness.

GDPR Articles: Art. 6 (1) GDPR
Industry: Media, Telecoms and Broadcasting