Vodafone España, S.A.U. fined EUR 60,000

On 28/Feb/2020, Vodafone España, S.A.U. received a privacy fine of EUR 60,000. The enforcement authority (Spanish Data Protection Agency) has cited these legal provisions in imposing the fine on Vodafone España, S.A.U.: Article 5 GDPR/ Article 6 GDPR/ GDPR/


Date of enforcement action:
Jurisdiction: Fine imposed:
Spain Flag for Spain, which is the jurisdiction taking enforcement action EUR 60,000 (US$65,200)
Defendant company or entity: Industry segment:
Vodafone España, S.A.U. Telecoms /

Case summary

Procedural history and facts: On February 21, 2019, the claimant states that he contracted the telephone services with another entity as a new client. Subsequently, he receives a series of text messages informing him that he has been registered with Vodafone España, S.A.U. and that his order is in process.

The claimant provided a screenshot of the text messages received and a copy of the delivery note for a package at his address. The claimant subsequently filed a complaint with the regulator.

It is recorded that on April 10, 2019, the complaint was transferred to the defendant in the proceedings with reference E/04041/2019.

The notification was delivered on 15 April 2019. No reply was received from Vodafone España, S.A.U.

On 17 September this year, a new request for information was sent to the party complained of, in the proceedings with reference E/07681/2019. The notification was submitted on the 18th of the same month and year, and no reply was received by this Agency.

Reasoning of the regulator (AEPD): The documentation in the file provides evidence that the claimed company violated Article 6.1 of the GDPR, since a fraud in the contracting process took place, as well as in the request for the order that was made on behalf of the claimant without his consent. The Contentious-Administrative Chamber of the National Court, in cases such as the one presented here, has considered that when the owner of the data denies the contract, the burden of proof falls on the person who affirms its existence, and the person responsible for the processing of third party data must collect and keep the necessary documentation to accredit the owner’s consent. We cite, for all, the SAN of 31/05/2006 (Rec.539/2004). However, and this is the essential point, the claimed party has not accredited that the owner of the personal data being processed gave consent to the conclusion of a contract with the claimed entity. It did not comply with the inexcusable obligation imposed on it by the data protection legislation to prove that it obtained the data subject’s consent to its processing. The defendant did not prove that the data subject gave his consent, nor did he provide any document or evidence to prove it, and he did not exercise the minimum diligence required to verify that his interlocutor was in fact who he claimed to be.

Result: The balance of the circumstances referred to in Article 83.2 of the GDPR, with respect to the infringement committed by violating the provisions of Article 6 thereof, allows for a penalty of 60,000 euros (sixty thousand euros), classified as “very serious”, for the purposes of prescription of the same, in Article 72.1.b) of the LOPDGD



The complainant signed up for telephone services with a third party company, i.e. not Vodafone España, S.A.U. Subsequently, the data subject was enrolled and sent contractual material by Vodafone España, S.A.U., which he had not been dealing with. The basis upon which Vodafone España, S.A.U. dealt with his file, purported to contract with him and processed his data was the subject to the complaint. The regulator found that Vodafone España, S.A.U. had no legal basis to process data relating to the complainant. It found, in the absence of proof to the contrary, that the data subject had not consented as Article 6 would require in this circumstance.

The regulator considered the case “very serious” according to its reasons.

Applicable legal provisions

Enforcement information

Enforcement authority: Type of enforcement action:
Spanish Data Protection Agency Flag for Spain, which is the jurisdiction taking enforcement action Penalty notice
Subject to appeal?

File or case number


Cite this fine in your work

Data Privacy Fines Index. (2020-02-28 10:18) Vodafone España, S.A.U. fined EUR 60,000. dataprivacyfines.com. Retrieved from https://dataprivacyfines.com/fine/vodafone-espana-s-a-u-fined-eur-60000/

Entry last updated: 2020-04-28 10:34 GMT.