# Vodafone GmbH: Non-compliance with general data processing principles

- Type: Enforcement
- Source: The Federal Commissioner for Data Protection and Freedom of Information (BfDI)
- Date: 2025-01-01
- Original: https://www.enforcementtracker.com/ETid-2646
- Canonical: https://overview.legal/posts/48761
- Topics: Controllers, Processors, IP Address, Security, Telecommunications, Data Processor, Privacy by Design & Default, Human Resources, Processing, Access Controls

## Summary

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) has imposed a fine of EUR 45,000,000 on Vodafone GmbH. The controller failed to properly supervise a third agency, which the controller used as a data processor. This resulted in employees of the third agency defrauding the controller's customers. The controller also failed to implement sufficient technical and organizational measures during an authentication process, which created the risk of third parties gaining ac

## Full text

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) has imposed a fine of EUR 45,000,000 on Vodafone GmbH. The controller failed to properly supervise a third agency, which the controller used as a data processor. This resulted in employees of the third agency defrauding the controller's customers. The controller also failed to implement sufficient technical and organizational measures during an authentication process, which created the risk of third parties gaining access to customers' personal data. The BfDI emphasized the good cooperation with the controller throughout the process.

GDPR Articles: Art. 28 (1) GDPR
Industry: Media, Telecoms and Broadcasting

---
Generated by overview.legal · https://overview.legal/posts/48761 · 2026-08-22