# VODAFONE SERVICIOS, S.L.U.: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2021-10-26
- Original: https://www.enforcementtracker.com/ETid-888
- Canonical: https://overview.legal/posts/47003
- Topics: Personal Data, Controllers, Telecommunications, Processing Agreement, Processing, Data Controller, Supervisory Authorities, Law Enforcement

## Summary

The Spanish DPA (AEPD) has imposed a fine on VODAFONE SERVICIOS, S.L.U.. A data subject filed a complaint with the DPA against the controller. The data subject is a client of the controller. When he checked his bills on the official website 'MY VODAFONE' last December, he found that he had four outstanding bills, but he could not access them. He had also received a number of requests to pay them. He was informed that there was a parallel account at Vodafone with details that partly corresponded

## Full text

The Spanish DPA (AEPD) has imposed a fine on VODAFONE SERVICIOS, S.L.U.. A data subject filed a complaint with the DPA against the controller. The data subject is a client of the controller. When he checked his bills on the official website 'MY VODAFONE' last December, he found that he had four outstanding bills, but he could not access them. He had also received a number of requests to pay them. He was informed that there was a parallel account at Vodafone with details that partly corresponded to those of him. As it turned out, fraudsters had concluded a mobile phone contract using the personal data of the data subject. However, the personal data had been entered into the company's information systems without any verification that the contract was lawful and had actually been concluded by the data subject. The original fine of EUR 50,000 was reduced to EUR 40,000 due to voluntary payment.

GDPR Articles: Art. 6 (1) GDPR
Industry: Media, Telecoms and Broadcasting

---
Generated by overview.legal · https://overview.legal/posts/47003 · 2026-08-22