BfDI imposes fines of 45 million euros on Vodafone

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) has imposed 45 million euros in fines on Vodafone.
Categories:

The Federal Commissioner for the Data protection The Federal Commissioner for Data Protection and Freedom of Information (BfDI), Prof. Dr. Louisa Specht-Riemenschneider, has imposed two fines totaling 45 million euros on Vodafone GmbH. The sanctions focus on deficiencies in dealing with processors as well as deficiencies in the technical and organizational security of processing systems.

Insufficient control of processors

The starting point was numerous complaints about fraudulent contract conclusions by employees of partner agencies that broker customer contracts on behalf of Vodafone. In particular, fictitious contract amendments and unauthorized contract conclusions to the detriment of customers were identified. These incidents have revealed structural weaknesses in the data protection management of the processors used.

A fine of 15 million euros was imposed for these failures. The BfDI found that Vodafone had failed to comply with its data protection obligations pursuant to Art. 28 (1) sentence 1 GDPR was not sufficiently complied with. Thereafter Responsible persons is obliged to engage only those processors that offer sufficient guarantees that suitable data protection measures are in place. Technical and organizational measures be taken in order to Processing in accordance with the GDPR ensure.

In particular, there was a lack of appropriate selection and ongoing monitoring of the partner agencies. These incidents illustrate a problem that is frequently encountered in practice: the data protection responsibility for commissioned Third is often underestimated or neglected, which poses considerable risks for Affected parties can entail.

Reading tip: These are the five highest GDPR fines in May 2025

Shortcomings in technical safety

A second key point of criticism from the BfDI concerned vulnerabilities in the authentication process for the combined use of the "MeinVodafone" customer portal and the Vodafone hotline. These security gaps allowed unauthorized Third to eSIM profiles and thus to personal data access. For this Infringement against Art. 32 para. 1 GDPR a further fine of 30 million euros was imposed.

Art. 32 GDPR obligated Responsible persons to implement appropriate technical and organizational measures to ensure a level of protection commensurate with the risk. The Vodafone case is an example of the dangers that can arise from inadequate authentication mechanisms. And this at a time when threat scenarios from cyber attacks and Social engineering steadily increasing.

BfDI praises Vodafone: All circumstances disclosed during proceedings

Vodafone has responded comprehensively to criticism from the data protection supervisory authority. According to the BfDI, sales processes have been revised, systems modernized and security architectures fundamentally improved. The selection and control processes for partner agencies have also been restructured. In the process, the company has parted ways with problematic contractual partners. In a follow-up inspection, the BfDI now wants to check whether the measures taken are effective in the long term.

It should be particularly emphasized that Vodafone cooperated fully throughout the proceedings and also disclosed self-incriminating circumstances. The fines were accepted and have already been paid in full to the federal treasury.

Monitoring of processors

The Vodafone case is exemplary of the structural challenges many companies face in the area of data protection compliance. As the BfDI points out, there is an investment backlog in IT modernization in many industries. As a result, savings are often made on security, while the monitoring of processors is neglected.

Nevertheless, the example also shows that data protection can gain strategic importance for companies. Vodafone has not only strengthened its internal structures in the course of the investigation, but has also donated several million euros to organizations that are committed to data protection, media literacy and digital literacy.

By imposing fines, the BfDI is sending a clear signal: data protection violations do not remain without consequences. At the same time, the authority is pursuing a constructive approach: companies that take data protection seriously and are transparent are to be supported.

Source: Communication from the Federal Commissioner for Data Protection and Freedom of Information (BfDI) on the fine proceedings against Vodafone

Tags:
Share this post :