Vodafone España, S.A.U.
Insufficient legal basis for data processing
Decision Date
October 19, 2021
Authority
Spanish Data Protection Authority (aepd)
ES
Sector
Media, Telecoms and Broadcasting
Country
ES
Law
GDPRStatus
FINALDescription
The Spanish DPA (AEPD) has fined Vodafone España, S.A.U. EUR 40,000. An individual had filed a complaint with the DPA against Vodafone for debiting his bank account in May 2020 for a Vodafone telephone line whose owner was not him but his ex-partner. As it turned out, the complainant's ex-partner had concluded a contract with Vodafone in his name. She stated that she was authorized to do so, but did not provide any proof of this. The DPA found that Vodafone had unlawfully processed the complainant's data. Indeed, compliance with the principle of lawfulness in the processing of third party data requires that the controller is able to prove lawfulness.