Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Vodafone España, S.A.U.: Non-compliance with general data processing principles

The Spanish DPA has imposed a fine on Vodafone España, S.A.U..

€56,000 Fine
Vodafone España, S.A.U.
SPAIN
Art. 5 GDPR Art. 32 GDPR
Integrity and Confidentiality Principle Security Personal Data Processing Privacy by Design & Default
Oct 31, 2022 Source aepd.es

Full text

The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA for having unsuccessfully requested a copy of their phone contract from Vodafone several times. Finally, the person received an e-mail, but with the phone contract of another customer. The DPA considered this to be a violation of the principle of integrity and confidentiality as set out in Art. 5 (1) f) GDPR. In addition, the DPA found that Vodafone failed to implement adequate technical and organizational measures to protect personal data, which could have prevented the incident. The original fine of EUR 70,000 was reduced to EUR 56,000 due to voluntary payment.

Industry: Media, Telecoms and Broadcasting

How it connects

References

Related across sources

C-119/12 Judgment of the Court (Third Chamber), 22 November 2012.#Josef Probst v mr.nexnet GmbH.#Reference for a preliminary ruling from the Bundesgerichtshof.#Electronic communications — Directive 2002/58/EC — Article 6(2) and (5) — Processing of personal data — Traffic data necessary for billing and debt collection — Debt collection by a third company — Persons acting under the authority of the providers of public communications networks and electronic communications services.#Case C‑119/12. In Case C-119/12, the Court of Justice of the European Union interpreted Article 6(2) and (5) of Directive 2002/58/EC (the ePrivacy Directive) in proceedings between Josef Probst… CJEU Nov 22, 2012 Personal Data Processing Telecommunications
C-741/21 GP v juris GmbH In Case C-741/21, the Court of Justice of the European Union (Third Chamber) addressed a preliminary reference from the Landgericht Saarbrücken in proceedings between data subject… CJEU ·Third Chamber Apr 11, 2024 Liability Personal Data Integrity and Confidentiality Principle
C-340/21 VB v Natsionalna agentsia za prihodite C-340/21 (VB v Natsionalna agentsia) CJEU Dec 14, 2023 Integrity and Confidentiality Principle Data Breaches Notification Obligation
15625/2026 Cass.Civ. - 15625/2026 Istituto nazionale della previdenza sociale (INPS, the controller) is the Italian National Institute for Social Security. In 2021, the DPA fined the controller €300,000 for its… Supreme Court May 21, 2026 Privacy by Design & Default Privacy by Design DPIA
Us I-4772/2023-10 A utility and municipal services enterprise, Zagrebački Holding d.o.o (the controller) provided users of its services with the option to request a copy of their bill via email. Where the name appearing in the email address differed from the user’s… US Zagreb - Us I-4772/2023-10 ·Administrative Court of Zagreb Jul 22, 2026 Personal Data Retention Period Controllers
Guidelines 4/2019 Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines on data protection by design and by default Guidelines ·EDPB Oct 20, 2020 Privacy by Design & Default Privacy by Default Privacy by Design
Related documents