In March 2021, the Spanish Data Protection Agency (AEPD) imposed a historic fine on Vodafone Spain of no less than €8.15 million. This amount was notable not only for its size but also for what it revealed: a series of serious failures in how they managed their users’ personal data, at a time when privacy is increasingly important and demanding.
Context
The investigation began after receiving numerous complaints from individuals who reported receiving unwanted commercial calls and messages, even after registering with the Robinson List, a free service to opt out of unsolicited advertising. But this was just the beginning of a more complex story.
During its investigation, the AEPD found several serious violations of both the General Data Protection Regulation (GDPR) as well as other related laws, such as the Law on Information Society Services and Electronic Commerce (LSSICE) and the General Telecommunications Law.
Development
Among the most severe issues was the fact that the marketing service was outsourced to external companies without due diligence in verifying the guarantees these third parties provided regarding compliance with data protection regulations. In other words, Vodafone had delegated certain campaigns to partner companies but did not ensure these complied with data protection rules. As a result, illegal processing of personal data was carried out without an appropriate legal basis or for purposes different from those informed.
Another key issue was the international transfers of personal data to countries outside the European Economic Area without the necessary safeguards. The GDPR strictly regulates these types of transfers to prevent personal information from ending up in places lacking sufficient or equivalent protection to European standards. In Vodafone’s case, the AEPD detected that some data was sent outside the European Economic Area without any of the safeguards established in the GDPR, such as the standard contractual clauses approved by the European Commission.
Additionally, Vodafone was also fined for sending commercial electronic communications without the appropriate legal basis. Many users received advertising calls, emails, and SMS messages despite having expressed their opposition to this processing.
All of the above led the AEPD to impose the highest fine in its history up to that point.
However, Vodafone later decided to appeal the AEPD’s decision before the National Court, and in January 2025, the court reduced the fine to €4.5 million. Among other arguments, the National Court stated the following:
- There is no evidence of the benefits Vodafone obtained from the data processing that the AEPD considered an aggravating factor of the infringement.
- It disagrees with the AEPD’s classification of the communications as “massive.”
- It also questions the aggravating factor considered by the AEPD regarding “the social impact of the infringements.”
This outcome has been seen in different ways. For some, it is a warning for the AEPD to provide more detailed reasoning for its sanction decisions. For others, it is a clear warning to the business sector: protecting personal data must be a priority and taken seriously, as required by European regulations. Although the reduction of the fine does not release Vodafone from responsibility, it does set an important precedent on how data protection sanctions should be evaluated and justified.
Article written by:
Lawyer specialized in privacy and technology contracting
About Metricson
Metricson is a leading firm in legal services for innovative and technology companies, with strong expertise in privacy and security. Since its founding in 2009, we have provided advice to over 1,400 clients from 15 different countries, including startups, investors, large companies, universities, institutions, and governments. Additionally, at Metricson we are experts in identifying and managing security breaches in companies, helping them protect themselves against risks and threats.
If you want to contact us, don’t hesitate to write to us at contacto@metricson.com. We look forward to talking with you!