# VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2024-02-13
- Original: https://www.enforcementtracker.com/ETid-2272
- Canonical: https://overview.legal/posts/48387
- Topics: Controllers, Processing Agreement, Personal Data, Telecommunications, Consent, Data Controller, Processing, Supervisory Authorities, Law Enforcement

## Summary

The Spanish DPA imposed a fine of EUR 100,000 on VODAFONE ESPAÑA, S.A.U. for insufficient legal basis for data processing. The data subject had filed a complaint against the controller due to the fact that fraudulent third parties had requested the portability of their mobile line without their consent and had concluded a contract for the purchase of a cell phone in their name. The controller failed to adequately verify whether the contracts were lawful and had actually been concluded by the dat

## Full text

The Spanish DPA imposed a fine of EUR 100,000 on VODAFONE ESPAÑA, S.A.U. for insufficient legal basis for data processing. The data subject had filed a complaint against the controller due to the fact that fraudulent third parties had requested the portability of their mobile line without their consent and had concluded a contract for the purchase of a cell phone in their name. The controller failed to adequately verify whether the contracts were lawful and had actually been concluded by the data subject.

GDPR Articles: Art. 6 (1) GDPR
Industry: Media, Telecoms and Broadcasting

---
Generated by overview.legal · https://overview.legal/posts/48387 · 2026-08-22