AEPD (Spain) - PS-00240-2025
From GDPRhub
| AEPD - ps-00240-2025 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1)(f) GDPR Article 28 GDPR Article 32 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 23.11.2023 |
| Decided: | |
| Published: | 18.09.2026 |
| Fine: | 750000.0 EUR |
| Parties: | Vodafone España, S.A.U. |
| National Case Number/Name: | ps-00240-2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | ricardo |
The DPA fined Vodafone €750,000 for a lack of appropriate security measures leading to a data breach affecting its "Super WiFi" service. For the fine, the DPA considered similar previous infringements and the controller’s failure to conclude a processing agreement with its processor.
English Summary
Facts
Vodafone España, S.A.U., the controller, operated a service known as "Super WiFi" through a third-party processor. Following a data breach affecting the service, the DPA's investigation found that personal data processed on behalf of the controller had been accessed without authorisation.
The processor provided software services related to the Super WiFi service and processed and stored personal data of the controller's customers. The processor informed the controller of the security incident on 20 November 2023, and the controller notified the DPA of the personal data breach on 23 November 2023.
The controller submitted a processing agreement which stated that it had entered into force in December 2022. However, the agreement was only formally signed in September 2024, after the data breach had occurred. The controller argued that the agreement had already been binding before its signature and that the absence of a signature did not mean that no contract existed.
The controller also relied on two documents dated 22 December 2022 and 30 March 2023 to demonstrate that it had carried out audit and control activities concerning the processor. Neither document was signed and the DPA considered that they did not sufficiently demonstrate how the processor's security measures had actually been verified.
The controller also claimed that encryption measures had been imposed on the processor. However, the only reference to this measure in the file appeared in the controller's initial written reply to the DPA inspector, unsupported by documentation, and the information available to the DPA indicated that the affected data were accessible in unencrypted form. The documents relied on by the controller referred to pseudonymisation but did not establish that encryption had been implemented.
The controller raised several objections during the procedure. It argued in particular that a valid processing agreement already existed when the processing took place, that it had implemented adequate security and oversight measures, and that the previous sanctions should not be taken into account as an aggravating factor.
Holding
The DPA rejected the controller's arguments.
First, regarding Article 28 GDPR, the DPA held that a processor must be bound by a written contract or other legal act from the moment it begins processing personal data on behalf of the controller. Although the agreement submitted by the controller referred to an effective date in December 2022, it was not formally signed until September 2024. The DPA considered that giving the agreement retroactive effect could not remedy the period during which processing had already taken place without a formally perfected agreement. Therefore, the controller infringed Article 28 GDPR.
The DPA stressed that allowing agreements concluded after processing had begun to operate retroactively would undermine the purpose of Article 28 GDPR. The processor must be formally subject to the controller's instructions and to the safeguards required by the GDPR throughout the processing relationship, rather than having those safeguards formalised ex post.
Second, the DPA found an infringement of Article 32 GDPR. It considered that the technical and organisational measures implemented in relation to the processor were insufficient. In particular, the controller had not adequately demonstrated that relevant security measures were actually implemented and had relied substantially on information supplied by the processor without sufficiently verifying its effectiveness. The audit documents submitted by the controller did not explain the methodology used or demonstrate effective verification of the measures in practice.
The DPA also rejected the controller's reliance on encryption. The available documentation did not demonstrate that the affected personal data were encrypted, and documents concerning cryptography referred to pseudonymisation rather than encryption.
Third, the DPA held that the insufficient security measures resulted in a loss of confidentiality of personal data and therefore also constituted an infringement of Article 5(1)(f) GDPR. The DPA also considered two previous decisions against the controller, PS/00538/2021 and PS/00164/2022, as aggravating factors under Article 83(2)(e) GDPR. Both concerned infringements of Articles 5(1)(f) and 32 GDPR, and the controller had acknowledged its responsibility in both proceedings.
When determining the fines, the DPA took into account, among other factors, the nature and gravity of the infringements and the controller's degree of responsibility. It also considered the controller's habitual processing of large volumes of personal data as an aggravating factor under Article 76(2)(b) LOPDGDD.
The DPA imposed three administrative fines: €500,000 for the infringement of Article 5(1)(f) GDPR, €150,000 for the infringement of Article 32 GDPR and €100,000 for the infringement of Article 28 GDPR. The total fine therefore amounted to €750,000. No additional corrective measure was imposed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Case No.: EXP202400702
DECISION ON SANCTIONING PROCEEDINGS
Regarding the proceedings conducted by the Spanish Data Protection Agency and based
on the following,
BACKGROUND
FIRST: Notification of a Personal Data Breach
On November 23, 2023, this Agency was notified of a personal data breach involving
VODAFONE ESPAÑA, S.A.U., Tax ID No. A80907397 (hereinafter, VODAFONE).
The facts brought to the attention of this authority are as follows:
On November 20, 2023, a VODAFONE supplier (***ENTERPRISE.1, hereinafter
***ENTERPRISE.1) informed that entity of a security incident that affected a
file containing VODAFONE customer data. The affected customers
are users of ***APP.1. According to the information provided by the supplier, the
attacker (…).
The affected data pertains to customers who have downloaded ***APP.1; this
information contains (...).
(…)
SECOND: Initiation of ex officio proceedings
As a result of the known facts, on December 14, 2023, the Director of the
Spanish Data Protection Agency urged the Subdirectorate General of
Data Inspection (SGID) to initiate the preliminary investigative proceedings referred to
in Article 67 of Organic Law 3/2018, of December 5, on Data Protection
and the Guarantee of Digital Rights (hereinafter, LOPDGDD).
THIRD: Preliminary Investigative Procedures
The Subdirectorate General for Data Inspection proceeded to conduct
preliminary investigative procedures to clarify the facts in
question, pursuant to the functions assigned to supervisory authorities under
Article 57.1 and the powers granted in Article 58.1 of Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter GDPR), and in
accordance with the provisions of Title VIII of the LOPDGDD.
On November 20, 2023, a VODAFONE supplier reported a
security incident that affected a file containing VODAFONE customer data. The
customers affected are (…).
Number of affected individuals according to the notification: (…)
Type of data according to the notification: (…)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 2/49
The data controller states that the incident was communicated to those affected on
December 28, 2023.
1. Analysis of the data breach.
1.1. Chronology of events.
The incident originated from a cyberattack suffered by the
processor, which affected the personal data of the controller’s customers. According to
the controller, on 11/20/2023, its vendor ***ENTERPRISE.1, acting
in the role of processor, informed it of a security incident
that affected a file containing VODAFONE customer data.
The data controller states: “***ENTERPRISE.1 is a VODAFONE provider of
software services related to the Super Wifi 5 product, which is offered by
VODAFONE Spain. To provide these services, ***ENTERPRISE.1 has developed an
application through which it processes and stores data from VODAFONE users
who use the application.” The affected customers (…).
(…)
According to the information provided, ***ENTERPRISE.1 became aware of the unauthorized
access on 11/13/2023 as a result of a post on social media
containing messages alluding to the incident.
(…)
1.3. Impact of the breach. Possible consequences for those affected.
The data controller indicates the following number of affected individuals and the type of data
compromised:
Total number of affected customers: (…)
o (…)
Additionally, the data controller notes: “Of these potentially affected customers,
(…)”.
The data controller provides the following assessment of the incident: “(…). Therefore, the
main consequences for those affected could include stress, irritation,
confusion, as well as becoming targets of phishing campaigns or data theft.”
3. Security Measures.
3.1. Measures Implemented Prior to the Data Breach.
The data protection officer provides the following information regarding security measures in
place prior to the incident:
(…)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 3/49
(…)
4. Regulations on data processing.
4.1. Data Processing Agreement.
As previously indicated, the roles among the entities are as follows: VODAFONE acts as
the controller, and ***ENTERPRISE.1 (…).
A copy of the data processing agreement entered into between VODAFONE and
***ENTERPRISE.1, (…).
This agreement confirms that it includes, among other aspects:
“The purpose of the agreement is (…)”.
“The data importer shall process personal data solely in accordance with
documented instructions from the controller.”
“(…)
There was a sub-processing agreement between ***ENTERPRISE.1 and ***ENTERPRISE.2 for the
technical operation of the service. A copy of that contract, in English,
signed on March 2, 2022, is provided. (…).
4.2. Other documentation.
A copy of the risk analysis conducted, in English, is provided. The data controller
states: “This questionnaire was completed by the provider to verify that
***ENTERPRISE.1 complied with VODAFONE’s
minimum security requirements in its provision of services to VODAFONE.”
(…)
FOURTH: Turnover
According to the report generated by the AXESOR tool, the entity
VODAFONE has a turnover of 2,909,851,000 euros for the year
2024.
FIFTH: Agreement to initiate disciplinary proceedings and responses thereto.
On June 13, 2025, the Presidency of the Spanish Data Protection Agency
agreed to initiate disciplinary proceedings against the respondent, in accordance with the
provisions of Articles 63 and 64 of Law 39/2015, of October 1, on the
Common Administrative Procedure of Public Administrations (hereinafter,
LPACAP), for the alleged violation of Article 5.1.f) of the GDPR, Article 32 of the
GDPR, and Article 28 of the GDPR, as defined in Article 83(5) of the GDPR (the first)
and Article 83(4) of the GDPR (the latter two).
Upon notification of the aforementioned decision to initiate proceedings in accordance with the provisions of Law
39/2015, of October 1, on the Common Administrative Procedure of
Public Administrations (hereinafter, LPACAP); on July 14, 2025, the
respondent submitted a written statement of arguments, which were addressed in the proposed
resolution.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 4/49
SIXTH: Proposed Resolution
On November 28, 2025, a proposed resolution was issued and served on VODAFONE on
December 5, 2025. VODAFONE requested an extension of the deadline to respond, which was
granted by a written notice dated December 10, 2025.
On December 30, 2025, VODAFONE filed a brief of arguments in which it
it states, in summary: that VODAFONE has not violated Articles 28, 32, and 5(f)—all
of which are articles of the GDPR—essentially because the data processing agreement was in effect on the date
of the incident.
Based on the proceedings conducted in this case and the documentation
on file, the following has been established:
ESTABLISHED FACTS
FIRST: Beginning on November 11, 2023, VODAFONE’s information systems
were the target of a cyberattack that affected (…).
SECOND: As a result of the cyberattack, the intruder gained access to
personal data of VODAFONE customers who were using said service. Consequently,
a data breach occurred, compromising the confidentiality
of the data.
THIRD: On November 23, 2023, this Agency was notified of this personal data breach
by VODAFONE.
FOURTH: The personal data affected by the cyberattack, in terms of volume and
categories, were as follows:
Categories of data Categories of data Volume of data
of data subjects
Customers (…) (…)
individuals and
microenterprises
TOTAL AFFECTED (…)
FIFTH: The causes of the loss of confidentiality were as follows:
(…)
SIXTH: The following deficiencies have been identified in the technical and
organizational measures of all kinds related to the data breach that
led to the loss of confidentiality
- (…)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 5/49
SEVENTH: A lack of security measures has been identified in the
processing of personal data, not directly related to the data breach that caused
the loss of confidentiality:
- (…)
EIGHTH: At the time the data breach occurred, there was no
validly executed data processing agreement
between VODAFONE and ***ENTERPRISE.1. (…).
LEGAL GROUNDS
I
Jurisdiction
In accordance with the powers granted by Article 58.2 of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter GDPR) grants to each
supervisory authority, and in accordance with Articles 47, 48.1, 64.2, and 68.1 of
Organic Law 3/2018, of December 5, on the Protection of Personal Data and
the Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency
has jurisdiction to
resolve this proceeding.
Likewise, Article 63.2 of the LOPDGDD provides that: “The proceedings
handled by the Spanish Data Protection Agency shall be governed by the provisions
of Regulation (EU) 2016/679, this Organic Law, the
adopted to implement it, and, to the extent they do not contradict them, on a
subsidiary basis, by the general rules on administrative procedures.”
II
Preliminary Issues
1. General Aspects of Processing
Article 4(1) of the GDPR defines “personal data” as: “any information relating to an
identified or identifiable natural person (‘the data subject’); an identifiable natural person
is one whose identity can be determined, directly or
indirectly, in particular by reference to an identifier such as a name,
an identification number, location data, an online identifier, or one or
more factors specific to the physical, physiological, genetic, mental,
economic, cultural, or social identity of that person.”
Article 4(2) of the GDPR defines “processing” as: “any operation or set
of operations performed on personal data or sets of personal data, whether
whether or not by automated means, such as collection, recording, organization,
structuring, storage, adaptation or alteration, retrieval, consultation,
use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure, or destruction.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 6/49
Article 4(7) of the GDPR defines the “controller” or “data controller”
as: “the natural or legal person, public authority, agency, or other body which,
alone or jointly with others, determines the purposes and means of the processing; if Union law
Union or of the Member States determines the purposes and means of the processing, the
controller or the specific criteria for its appointment may be
established by Union or Member State law.” In turn, Article
4(8) of the GDPR defines the “processor” as the
natural or legal person, public authority, agency, or other body that engages in personal data processing
on behalf of the controller.
2. Liability for Infringements
In the present case, in accordance with the provisions of Articles 4(1) and 4(2) of the GDPR,
it is established that personal data processing has taken place, since VODAFONE
carries out, among other processing activities, the collection and storage of personal data
of natural persons, including identifying information, documentary data, contact information, data
relating to contracted services, and economic or financial data.
VODAFONE carries out this activity in its capacity as the controller,
since it is the entity that determines the purposes and means of such activity, pursuant to Article
4.7 of the GDPR.
Both in the notifications regarding the breach and in its responses to the
requests for information from this Agency’s Inspectorate, VODAFONE
asserts its lack of liability with respect to the events that occurred based on two
factors. First, that the breach physically occurred in the
systems or infrastructure of ***ENTERPRISE.1 and its data processor ***ENTERPRISE.2.
second, that it had entered into the appropriate data processing agreement
with said enterprise, ***ENTERPRISE.1. This agreement reportedly included
instructions to the processor, particularly those relating to security measures
for personal data.
With regard to the liability of the controller or processor,
indeed, the principle of liability set forth in Article 28 of the LRJSP
provides that: “Only natural and legal persons may be sanctioned for acts constituting an
natural and legal persons, as well as—when a law
grants them the capacity to act—groups of data subjects, associations, and entities without
legal personality, and independent or autonomous estates, which are
found liable for such acts due to willful misconduct or negligence.” However, the manner in which
liability is attributed to legal entities does not correspond to the
forms of intentional or negligent culpability that are attributable to human
conduct. Thus, in the case of violations committed by legal entities,
although the element of culpability must be present, it is necessarily applied
differently than it is with respect to natural persons.
According to Constitutional Court Ruling 246/1991, of December 19, Rec. 1274/1988, “(...) this distinction
distinct interpretation of the legal entity’s liability for the offense stems from
the very nature of the legal fiction to which these entities are subject. They lack
the element of volition in the strict sense, but not the capacity to violate the rules to
which they are subject.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 7/49
Capacity to commit an offense and, therefore, direct culpability stemming from the
legal interest protected by the rule that is violated and the need for such protection
be truly effective and the risk that, consequently, must be assumed by the
legal entity subject to compliance with said rule” (in this regard, Supreme Court Ruling of November 24,
2011, Case No. 258/2009).
For its part, the Judgement of the Court of Justice (Grand Chamber) of December 5,
2023, rendered in Case C-807/21, states:
“41. Furthermore, the Court of Justice has already held that any natural
or legal person who, in pursuit of its own objectives, influences the processing of personal
data and thus participates in determining the purposes and means of the
processing may be considered a controller (see, in this
regard, the judgement of July 10, 2018, Jehovan todistajat, C-25/17,
EU:C:2018:551, paragraph 68).
42. Thus, it follows from the wording and purpose of Article 4(7) of the GDPR
that the EU legislature has not established, for the purposes of determining
liability under that Regulation, a distinction between
natural persons and legal entities, since that liability is subject solely to the
requirement that they, alone or jointly with others, determine the purposes and
means of the processing of personal data.
43. Therefore, without prejudice to the provisions of Article 83(7) of the GDPR
regarding public authorities and bodies, any person who meets this
requirement—whether a natural person, legal person,
public authority, agency, or other body—shall be liable, in particular, for
any infringement referred to in Article 83(4) to (6) of the GDPR
committed by that person or on that person’s behalf.
44. With regard to legal entities, this implies, on the one hand—as the Advocate General has
essentially noted in points 57 through 59 of his Opinion—
that they are liable not only for infringements committed by their
representatives, directors, or managers, but also by any other person who
acts within the scope of those legal entities’ business activities and on their
behalf. On the other hand, the administrative fines provided for in Article 83 of the GDPR
in the event of such infringements must be capable of being imposed directly
on legal entities when they can be classified as controllers of the
processing in question.
(…)
46. Thus, a combined reading of Articles 4(7), 83, and 58(2)(i)
of the GDPR shows that an administrative fine
for an infringement referred to in Article 83(4) to (6) may also be imposed on
legal entities when they act as controllers.
Conversely, no provision of the GDPR allows for the conclusion that the imposition of
an administrative fine on a legal entity acting as a controller is
subject to a prior finding that the infringement was committed by a
specific natural person.”
The Role of the Processor
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 8/49
The role of the processor arises from the need to address
phenomena such as the outsourcing of services by enterprises and other
entities, such that in cases where the controller
entrusts a third party with the provision of a service that requires the
processor to process personal data on its own behalf, the processing or processing operations
are carried out by the processor, in the name and on behalf of the
controller, as if it were the controller itself carrying out the processing.
In the present case, according to the information provided by VODAFONE, the
services entrusted to the processor would be, according to
VODAFONE’s response to the Agency inspector’s request, the
following
“***ENTERPRISE.1 is a service provider for VODAFONE (…), which is
offered by VODAFONE Spain. To provide these services, ***ENTERPRISE.1
has developed an application through which it processes and stores data on
VODAFONE Users who use the application (hereinafter, the “application”).
The app offers the user (…).
According to the notification issued by ***ENTERPRISE.1, (…).”
The website www.VODAFONE.es provides an explanation of (…).
The existence of a processor depends on a decision made by
the controller, who may decide to carry out certain
processing operations on their own or to contract out all or part of the processing to a
processor.
In other words, in order to qualify as a processor, the processor must not have any self-interest regarding the
outcome of the processing for which it is engaged, notwithstanding the financial
compensation it receives for the service provided, which is the case here. Processors have no interest of their own; they act on behalf of and in the name
of the controller, carrying out the controller’s instructions and for the controller’s purposes, and this is what
determines that they are processors from the outset.
This means that the controller is liable for actions
contrary to the GDPR carried out by its processors, unless
the latter acted as actual controllers,
deciding on the purposes and means of the processing—a situation that did not occur in
the present case.
EDPB Guidelines 7/2020 on the concepts of “controller” and “processor” in the GDPR, version 2.0, adopted on July 7, 2021, state that,
“30 In line with the fact-based approach, the word
‘determines’ means that the entity that actually exercises decisive influence
over the purposes and means of the processing is the controller. Generally, the
data processing agreement specifies who is the determining party (the
controller) and who is the party that follows instructions (the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 9/49
processor). Even when the processor
provides a service that is predefined in a specific manner, it must
submit a detailed description of the service to the controller,
and the controller must make the final decision regarding approval of how the
processing will be carried out and request any changes it deems necessary.
Furthermore, the processor may not modify, at a later time,
the essential elements of the processing without the approval of the
controller.
(…)
39. The question is where to draw the line between decisions
reserved for the controller and those that may be left to the
discretion of the processor. It is clear that decisions regarding the purpose of the
processing must always rest with the controller.
Responsibility, therefore, rests with the party that determines the means and purposes of the
processing. In this case, VODAFONE ESPAÑA S.A.U.
As stated in the Judgement of the National Court—Administrative Chamber, dated
February 8, 2024 (Case No.: SAN 595/2024), in its Legal Rationale
Third party:
“The first ground for appeal raised by the plaintiff is that it cannot be
considered the principal offender of the alleged violation, insofar as the
processors did not carry out the processing in accordance with the procedures
determined by ***ENTERPRISE.3; and, therefore, pursuant to the provisions of Art.
28.10 of the GDPR, they should have been considered by the Spanish Data Protection Agency
(hereinafter AEPD) as controllers,
and the sanctioning proceedings
that are the subject of this litigation should have been initiated—where applicable—against them.
(…)
However, it has not been proven that the aforementioned enterprises, as processors
for the plaintiff, determined the purposes and means of the processing, nor
did they use the plaintiff’s customer data for their own purposes, nor did they
interacted with data subjects outside the structure and trade name of the
appellant company; rather, they acted under the plaintiff’s name to
fulfill the plaintiff’s purpose, using the plaintiff’s systems to carry out
transactions with customers. Therefore, Article 28(10) of the GDPR cannot be invoked to
attribute alleged liability to the processors, which, moreover, would imply the
exoneration of the controller, that is, the appellant company.”
In accordance with the provisions of the Supreme Administrative Court ruling of October 29, 2024, Case No. 1824/2021,
the controller has the obligation, with respect to its processors,
to supervise them by implementing all types of security and monitoring systems and measures
security and monitoring to verify and demonstrate compliance with the GDPR: “the data controller has
the obligation to supervise the processing carried out by its processors by implementing all types
of security and monitoring systems and measures that verify compliance with
their instructions and compliance with data protection regulations, and, pursuant to
the principle of proactive accountability (Article 5.2 of the GDPR), be able to
demonstrate it.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 10/49
For its part, the recent Judgement of the Court of Justice (Grand Chamber) of December 2,
2025, rendered in Case C-492/23, establishes with respect to the controller:
“56. Article 4(7) of the GDPR broadly defines the concept of
the controller or controller as the natural or legal person, public authority,
agency, or other body that, alone or jointly with others, determines the purposes and
means of the processing of personal data.
57. The purpose of this broad definition is, in accordance with the GDPR, to
to ensure effective protection of the fundamental rights and freedoms of
natural persons and a high level of data protection of every individual’s right to
the protection of personal data concerning them (Judgement of December 5,
2023, C-682/2021…).
58. Thus, any natural or legal person who, in pursuit of its own objectives,
influences the processing of such data and thereby participates in determining the
purposes and means of the processing may be considered a controller of such
processing (Judgement of December 5, 2023, C-682/2021…)
(…)
71. Indeed, the Court of Justice has already held, in essence, that the natural or legal person who influences
determination of the means of processing any natural or legal person who exerts a
decisive influence on the collection and transmission of personal data, or even
anyone who, through their configuration actions, influences—based on their objectives
of management or promotion of their activities—the processing of such data (Judgement
of June 5, 2018, C-40-17…).
(…)
85. Second, Chapter IV of the GDPR specifies the scope of the obligations
imposed on the controller of personal data, in accordance with the
principle of accountability set forth in Article 5(2) of the GDPR.
86. Pursuant to this provision, the controller is responsible for
compliance with the provisions of paragraph 1 of that same article and must be able
to demonstrate that it complies with each of the principles set forth in paragraph 1,
such that the burden of proof rests with the controller (Judgement of May 4, 2023,
C-60/22 …).
87. The principle of accountability is further elaborated, in particular, in Article 24 of the
GDPR (see, to that effect, the Judgement of January 25, 2024,
MediaMarktSaturn, C-687/21). That provision requires that, taking into account the
nature, scope, context, and purpose of the processing, as well as the risks of
varying likelihood and severity to the rights and freedoms of natural persons,
the controller implement appropriate technical and organizational measures
ensure and be able to demonstrate that the processing complies with said
Regulation.
88. Thus, Articles 5(2) and 24 of the GDPR impose on the controller
of personal data general obligations of accountability and
compliance. These provisions require the controller to adopt
measures aimed at preventing possible violations of the rules established
by the GDPR, in order to guarantee the right to data protection (see, in this
regard, the Judgement of October 27, 2022, C-129/21).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 11/49
89. In this regard, Article 25(1) of the GDPR imposes on the controller
the obligation to implement, both when determining the means
of processing and at the time of the processing itself, appropriate technical and
organizational measures designed to effectively implement the principles of
data protection and to incorporate the necessary safeguards into the processing, in order to
comply with the requirements of this Regulation and protect the data subject rights.
Furthermore, Article 25(2), concerning data protection by
default, provides, in particular, that the appropriate technical and organizational measures
that the controller must implement for this purpose must ensure that, by
default, personal data is not accessible, without the involvement of the data
subject, to an indeterminate number of natural persons.
(…)
117. The Court of Justice has already held that the reference in Article
32(1) and (2) of the GDPR to a level of security appropriate to the risk and to
adequacy of the level of security makes it clear that this Regulation establishes
a risk management framework and that it in no way seeks to achieve erasure
of the risks of personal data breaches (Judgement of December 14,
2023, C-340/21).
118. Thus, from the wording of Article 32 of the GDPR, in conjunction with Article 24 of the same
Regulation, it follows that Article 32 merely requires the controller
to implement technical and organizational measures designed to prevent, to the
greatest extent possible, any personal data breach. The
appropriateness of such measures must be assessed on a case-by-case basis,
by examining whether the controller has adopted those measures taking into account the
various criteria set forth in the aforementioned articles and the data
protection needs specifically inherent to the processing in question and the
risks it entails (see, in this regard, the Judgement of December 14, 2023,
C-340/21)
This is the case even in light of the processor's data processing agreement. However,
to elaborate further—and as will be analyzed more thoroughly later—since
the processor's data processing agreement is itself the subject of the alleged infringement, it cannot
be considered validly concluded and in force as of the date of the data breach.
The copy provided by VODAFONE shows that, in the space where the
signatures of the enterprises’ authorized representatives appear, there is the electronic signature of two
VODAFONE representatives; however, among the characteristics of that signature is the
date on which it was created. And this is “2024.09.04.” It can be seen that it is in
Anglo-Saxon format and refers to September 4, 2024. Even under the
interpretation most favorable to VODAFONE (April 9, 2024), this would be well
after the data breach occurred, which took place on November 20, 2023.
Consequently, VODAFONE should be held liable as both the controller
and the person responsible for the violations that occurred in connection with the
data breach.
III
Response to the Arguments Submitted Regarding the Initiation Agreement
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 12/49
The order of presentation follows that of the written arguments submitted in response to the opening agreement
FIRST: Violation of Article 28 of the GDPR
Essentially, the arguments presented by VODAFONE regarding this violation are
divided into two parts. On the one hand, regarding the commission of the violation itself; on the other,
regarding the amount of the proposed penalty.
Commencement of the Infringement of Article 28 of the GDPR
The alleged infringement consists of the fact that the processor agreement with the
enterprise ***ENTERPRISE.1 was signed after the
data breach involving personal data occurred, meaning it was not in effect as of that date. Although
the respondent acknowledges this fact (…).
VODAFONE considers that the lack of a signed contract does not in itself imply the
non-existence of the contract or, consequently, a violation of Article 28 of the GDPR.
It asserts that, in accordance with the Civil Code, the contract exists from the moment of the
convergence of the parties’ intentions.
As evidence of this assertion, the pleadings indicate that there is a
risk analysis document from ***ENTERPRISE.1 dated December 22, 2022, and that on
March 23, 2023, VODAFONE conducted an audit of its
processor (document attached to substantiate this).
This claim by VODAFONE cannot be accepted under any circumstances. To this end, we must
refer to Article 28(3) of the GDPR, which provides that:
“Processing by a processor shall be governed by a contract or other legal act in
in accordance with Union or Member State law, which binds the
processor in relation to the controller and sets out the subject matter, duration,
nature, and purpose of the processing, the type of personal data and categories
of data subjects, and the obligations and rights of the controller.”
According to the documentation and arguments submitted by the respondent,
there is evidence of a contract signed on September 6, 2024, which includes a
reference indicating that it entered into force on December 22, 2022. However, the
only evidence of the contract’s conclusion would be the signature (which guarantees the
involvement, knowledge, and consent) of the parties to the contract. Thus,
VODAFONE has not demonstrated that the contract was validly entered into prior
to the date of signature stated in the documentation on file, that is,
December 22, 2022.
It should be noted that the “Guidelines 07/2020 on the Concepts of ‘Controller’ and ‘Processor’ in the GDPR” establish the obligation
to formalize a data processing agreement, and that such an agreement be recorded on a
stable and durable medium:
“(101) This legal act must be in writing, with electronic format
permitted. Therefore, agreements not formalized in writing (with
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 13/49
regardless of their completeness or validity) cannot be considered
sufficient to meet the requirements set forth in Article 28
of the GDPR. To avoid any difficulty in proving the validity of the
contract or other legal act, the EDPB recommends ensuring that the
necessary signatures have been included in the legal act in accordance with the provisions of
applicable law.”
“(103) Since the Regulation establishes a clear obligation to enter into a
written contract, when no other relevant legal act is in
force, the absence of a contract will constitute a violation of the GDPR.”
In ordinary legal practice, there is nothing to prevent parties from entering into contracts
that provide for legal effects prior to the date of signature. This can be done in
areas such as civil or commercial law. For example, an employment contract that
provides for a pay raise effective prior to the date of signature. However, in the
context of the fundamental right to data protection, we cannot overlook the
purpose of the obligation established in Article 28(3) of the GDPR, which requires that a
contract between the controller and the processor be in place from the outset. The data processor
processes personal data for which the data controller is responsible, and it is necessary
for the data controller to establish the necessary safeguards and procedures to ensure that the
provisions of the GDPR are complied with—by both the data controller and the
processor. Recall that the processor acts on behalf of the data controller. The GDPR seeks to prevent
the increasingly widespread practice of contracting and subcontracting
services by the controller (outsourcing in
practice) from leading to an evasion of responsibility regarding compliance
with obligations in this area.
The processing of personal data by the processor begins the very
moment it starts performing the functions entrusted to it by the
controller. And from that moment on, the data processing agreement must be
validly entered into, signed, and formally finalized, as we have seen
established in Guidelines 07/2020. This is to ensure that the processor is
formally and substantively bound to comply with the obligations of the GDPR.
In this regard, it would be inconsistent with the GDPR to adopt a practice whereby,
as VODAFONE asserts, a data processing agreement were formally entered into on
a date such as September 2024, while stipulating that the contract’s entry into force
occurred in December 2022. Throughout that entire period, there
would be no formally executed contract and, consequently, no guarantees that the
processor would be subject to the obligations of the GDPR.
The argument, therefore, cannot be upheld, since the alleged
retroactive effect of the contract’s effective date does not remedy the absence of
a valid legal relationship during the period between the start of processing
and the actual formalization of the contract. The existence of a document with an earlier
effective date has no practical effect in terms of data protection
if there is no conclusive evidence that both parties had expressed and
documented their consent in accordance with the requirements of Article 28(3) of the
GDPR prior to the start of processing operations. Consequently, as long as
the contract is not formally finalized—that is, signed and in a written format
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 14/49
, the legal obligation binding the
processor to the controller cannot be considered fulfilled, nor can the
effective application of the measures and safeguards established by the GDPR be deemed guaranteed.
Similarly, accepting the retroactive effect of a data processing agreement would
render the requirement set forth in Article 28 of the GDPR meaningless, allowing for
the ex post regularization of situations in which processing has already been
carried out without the necessary legal safeguards. This would contravene the principle of
accountability, as it would cover periods during which the processor acted without
being formally subject to the obligations imposed by the GDPR.
Needless to say, this breach is in no way mitigated by the fact that, as
VODAFONE asserts, an audit or inspection was conducted on the
processor—a matter on which we will rule later. The obligation under Article
28 is the formal execution of a contract governing the relationship between the controller
and the processor and requiring the latter to comply with the obligations
of the GDPR. And in this case, the contract was neither validly executed nor in effect at
the time the breach occurred.
This argument must therefore be dismissed.
Circumstances for Determining the Amount
With regard to this section of the arguments, two fundamental aspects
should be noted. First, the respondent characterizes all of the
circumstances assessed in the decision to initiate proceedings as “aggravating.” And it must be clarified
that this is not the case. In accordance with Guidelines 04/2022 on the calculation of
fines under the GDPR, dated May 24, 2023, issued by the European Data Protection
(hereinafter, the “Fines Guidelines”), successive steps are followed to determine the amount
of the penalty.
The first step is to determine the initial amount of the penalty. This is
covered in Chapter 4, “Starting Point for the Calculation,” of the Guidelines (paragraphs
46 et seq.). To calculate the initial amount, certain
factors expressly identified in the Guidelines are taken into account. These include (in addition to,
obviously, the annual turnover) the “nature, gravity, and duration of the
infringement” (paragraphs 53 et seq.); the “intentional or negligent nature of the
infringement” (paragraphs 55 et seq.), and the “categories of data affected”
(paragraphs 57 et seq.). The application of these factors determines what would be the
base amount of the fine, to which aggravating or mitigating circumstances would then
be applied.
In the present proceedings, for each violation, the circumstances set forth in
the aforementioned Chapter 4 of the guide have been taken into account in
calculating the initial amount of the penalty. Specifically, the volume of business, the severity of
the violation, and the degree of intent or negligence involved, as well as, where applicable,
the type of personal data affected. Subsequently, the
existence of aggravating circumstances was assessed. Among these were the existence of
previous penalties and the respondent’s involvement in the processing of
personal data. This was stated in the decision to initiate proceedings, distinguishing between
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 15/49
circumstances for determining the amount, and, subsequently, aggravating or
mitigating factors.
We will now analyze the specific circumstances invoked.
Nature, gravity, and duration of the violation (Art. 83(2)(a) GDPR). There is a discrepancy
VODAFONE disputes the applicability of this circumstance, particularly the consideration
of the number of affected customers (...), arguing solely
that, since a validly executed contract exists, this
circumstance cannot be taken into account.
Since the disagreement regarding this circumstance stems from the
disagreement over whether the violation was committed in the first place, we refer to the response
already provided above.
Intent or negligence (Art. 83(2)(b) GDPR). In VODAFONE’s opinion,
negligence cannot be considered aggravated by the fact that this
enterprise regularly outsources services,
since this aspect would already be taken into account as an aggravating factor in connection with the
routine processing of personal data, which has also been applied.
The initial decision makes clear that, indeed, the
negligence is particularly serious due to the circumstances in which the
events attributed to the respondent occurred, which in practice resulted in
a relationship with a processor with whom it had not previously
formalized the conditions under which the processing of personal data
entrusted to it was to be carried out; particularly in terms
of guarantees and safeguards for the data subjects whose data were being
processed. This is a specific aspect considered in assessing the severity of
the negligence, and it is not the only factor applied for this purpose, as the
long period of time that has elapsed since this obligation took effect
under the GDPR (May 2018) is also mentioned. It is specifically taken into account because,
as indicated, the high volume of outsourced contracts should
make this an aspect requiring special vigilance and supervision on the part of
the controller.
A separate issue is the aggravating factor of a connection to the routine processing of
personal data under Article 76 of the GDPR, which applies to the processing of
personal data of end customers in relation to general aspects of
contracting, billing, complaints, etc., without being specifically
related to the outsourcing to data processors. However, it also applies to
this violation as an additional and distinct factor.
Categories of data affected (Art. 83(2)(g) GDPR). VODAFONE argues
that this circumstance should not be taken into account: “it is
applicable: as is evident from the record, (…)”
Indeed, upon reviewing both the initial agreement and the documents
on file, it is confirmed that (…) was not being processed by
***ENTERPRISE.1 and, therefore, was not affected by this data breach. In any case,
given that the type of personal data affected is a circumstance (neither
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 16/49
aggravating or mitigating factor) in determining the initial amount, the
affected data has been included.
Since the initial decision cited the particularly serious nature of having
been affected (…), when in fact this is not the case, it is proposed to reduce the
amount of the penalty for the violation of Article 28 of the GDPR.
Aggravating factor: the connection between the infringer’s activity and the processing of
personal data processing (Art. 76 LOPDGDD). This aggravating factor applies
in these proceedings when determining the amount of the fine. VODAFONE objects to this,
stating that VODAFONE’s primary activity is not the processing of
personal data, but rather the provision of electronic communications
. It further adds that the mere fact of processing personal data
on a regular basis cannot constitute an aggravating factor in liability.
In this regard, it should be noted that VODAFONE’s primary activity, while
not directly involving the processing of personal data, necessarily entails
necessarily the routine processing of such data. It enters into contracts with
citizens, responds to their inquiries, resolves their complaints, and handles
their billing, among many other services. In other words, it is not
a merely ancillary or indirect activity; rather, the provision of
provision of electronic communications services involves the performance
of multiple processing operations. Furthermore, the number of customers of this
operator is in the millions.
This is precisely the purpose of the aggravating factor provided for in Article 76.2.b) of the
LOPDGDD. A higher standard of diligence in the processing of personal data is required
of an enterprise (in this case, a large enterprise) whose
regular activity involves the continuous processing of personal data
(and with the involvement and guidance of a data protection
officer) than to those who do so only occasionally—whether they are individuals or small
enterprises—and do not have the same resources.
Therefore, this aggravating factor is fully applicable to VODAFONE in this
case.
SECOND: Violation of Article 5.1.f) of the GDPR
The respondent divides this section into four types of arguments, which will be
addressed in the order in which they appear in the document.
“Preliminary clarifications” regarding the loss of confidentiality
In this section, VODAFONE states the following:
- First, the fact that (…).
- Contrary to what is stated in the opening decision, VODAFONE did carry out
oversight measures regarding its processor, (…) (reference is made to documents
submitted to the inspector).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 17/49
Regarding these allegations, the following should be noted: with respect to the
point of entry, a distinction must be made between what that point of entry was and what
measures (or rather, the lack thereof) led to the loss of confidentiality.
It is true that the breach occurred because (…), but it is equally true that it was
successful due to certain deficiencies identified in the information systems.
Primarily, this third party’s system relied solely on (…).
With regard to data encryption, it should first be noted that the
respondent’s arguments do not specify in which specific document among those
submitted in the proceedings this measure is addressed. Upon analyzing these documents,
it is observed that the only reference to encryption is contained in VODAFONE’s first response
to the AEPD inspector. There, among the measures implemented prior to
the breach, the following is listed:
(…). As can be seen, encryption is applied to communications, albeit with
somewhat unclear wording. The data was in plain text and accessible based on the
information available. In fact, the initial breach notification states as much:
(…)
Additionally, in one of the documents provided by VODAFONE in response to the
inspector’s request—which, as will be seen later, is intended to demonstrate the
existence of audits of the data processor—the “Cryptography” section
mentions only “pseudonymization” techniques and never encryption or
encoded data.
Regarding possible audit and monitoring activities concerning the operations of the
processor, VODAFONE refers to two form-type
documents; one dated 12/22/2022 and the other undated (according to VODAFONE’s
assertions, the latter would be from March 30, 2023. Neither is signed.
Well, aside from these issues, these documents suffer from the following
shortcomings:
- The method of preparation or work procedure is not detailed. Rather,
it appears to be based on statements by the processor itself. In
any case, the “fieldwork” carried out to verify whether
the measures were in place is not described.
- In the section on risk management, the document merely lists a
series of principles and objectives, without specific measures, stating that they
are “fully in place.” Of course, it does not address
any of the measures that should be implemented in accordance with the
deficiencies identified in this procedure.
- As mentioned above, the “Cryptography” section
refers only to “pseudonymization” techniques and never to encryption or
encoding.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 18/49
- Most importantly, in the Information Security section, the
following measure is listed as “Fully Operational”:
(unofficial translation from English):
“Development and production environments require a VPN for access,
, and access is granted only for professional purposes. All our internal systems
require MFA, and no personal devices may be used to
access the development and production environments.”
Given the deficiencies identified regarding the lack of a VPN
for accessing ***ENTERPRISE.2 and the lack of two-factor authentication, it is reasonable to question
the effectiveness of controls and audits such as those conducted; thus, the
argument used in the opening agreement—that the data controller’s
The processor was limited to conducting a formal compliance check on
the processor, without detecting the problems that existed.
Possible liability of the processor for the violations.
According to VODAFONE’s allegations, the processor
***ENTERPRISE.1 deviated from the instructions given by VODAFONE. It includes
a list of specific mandates that the data processor allegedly failed to comply with.
The response to this allegation must be addressed from two perspectives. First,
whether the existence of a validly
entered into data processing agreement allows, in the event of a breach of any of the instructions,
for the processor to be held responsible for committing the
infractions. Second, whether, as VODAFONE asserts, said agreement contained
precise instructions such that, had they been strictly followed by
the processor, the personal data breach would not have occurred.
We will now focus on the first of these issues. That is, whether liability
for the violations committed in this case could fall on the processor. This depends on the arguments put forward by VODAFONE, both those
relating to the pre-contractual phase (selection of the processor), those during the term of the contract
(organizational and technical measures provided for therein), and those following the termination of the contract
(remedying the effects of the breach).
It should be clarified that this Agency does not consider that a data processing agreement
was validly entered into until September 6, 2024; for this purpose, we
refer both to the response to the arguments regarding Article 28 and to the
legal basis for this proposal, which analyzes that violation.
Turning now to the second issue (whether there were specific measures in the
data processing agreement), it should be noted that the agreement cannot be considered
validly concluded and in force until September 6, 2024, and thus at
after the breach (we refer to the response to the allegations and
the legal basis regarding the violation of Article 28 of the GDPR). Therefore, it is not
appropriate to analyze whether that contract contained specific instructions
whose compliance would have prevented the breach.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 19/49
Absence of Fault
In this section, the respondent raises no new arguments. It merely reproduces
Article 28.1 of Law 40/2015:
“Only natural and legal persons may be sanctioned for acts constituting an
natural and legal persons, as well as—when a law
recognizes their capacity to act—groups of affected parties, associations, and entities
without legal personality, and independent or autonomous estates, which
are found liable for such acts on the grounds of willful misconduct or negligence.”
It goes on to state that, in accordance with the interpretation provided by the
, invoking the absence of fault will not suffice for exoneration; rather,
it will be necessary to have exercised the due diligence required of the party asserting
its absence (among others, the Supreme Court Judgement of January 23,
1998.
And to prove such diligence, it does nothing more than refer to arguments already
made: the measures it had imposed on its processor, its
diligence in mitigating the effects of the breach, and the alleged oversight
actions it had carried out with respect to said processor. All of this has already been addressed in
previous sections of this brief. Both with regard to the possible
liability of the processor and, in general, regarding the measures
implemented (or their absence).
In any case, with regard to the principle of fault, it is fully applicable to
case is the Supreme Court ruling of October 17, 2007 (Case No. 63/2006), which, after noting that
entities whose business operations involve the continuous processing
of customer and third-party data must observe an adequate level of diligence, states:
“[...] the Supreme Court has held that negligence exists whenever
a legal duty of care is disregarded, that is, when the offender does not
act with the due diligence required. And in assessing the degree of diligence,
special consideration must be given to whether or not the party in question is a professional, and there is no doubt
that, in the case now under review, given that the appellant’s activity involves the
constant and extensive handling of personal data, particular emphasis must be placed on the
rigor and the utmost care in complying with the relevant legal provisions.”
Furthermore, the National Court, in matters of personal data protection,
has stated that “simple negligence or a breach of
the duties imposed by law on those responsible for filing systems or for the
data processing to warrant the exercise of the utmost diligence...” (Judgement of the National Court
of June 29, 2001).
Arguments Regarding Circumstances for Determining the Amount of the Fine.
It makes the following recitals regarding the circumstances taken into account
in these proceedings to determine the amount of the penalty.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 20/49
- Nature, severity, and duration of the violation (Article 83(2)(a) of the GDPR). Since
this section of the notice of initiation sets forth the
characteristics of the breach, the number of data subjects affected, and the absence of measures to
prevent it, VODAFONE considers that this
circumstance cannot be taken into account as an aggravating factor, since it actually constitutes the core or description of
the violation committed.
In this regard, we reiterate the confusion present in the arguments
of the respondent. According to the Fine Guidelines, the circumstances
described in subparagraphs (a), (b), and (g) of Article 83(2) of the GDPR are not
Recital 10 considers “aggravating factors,” but rather circumstances that allow for
determining the initial amount of the penalty (to which aggravating or mitigating factors may then be applied
if they apply).
In fact, it would make no sense to consider the general aspects of the
infringement (such as the number of affected customers, the presence of
intent or negligence, or the categories of data affected) as
aggravating factors, since these circumstances already provide
an overall picture of the scale and severity of the violation for the purpose of
determining the amount of the fine. And, at that point, the fine should be adjusted accordingly
if aggravating or mitigating circumstances exist.
For this reason, the circumstance referred to in Article 83(2)(a) of the GDPR is described in these
proceedings in the terms set forth in this proposal, outlining the
main factors at play that make it possible to determine the initial amount of
the penalty.
This is expressly established in the Guidelines on Fines:
“(46) The EDPB considers that the calculation of administrative fines should
begin from a harmonized starting point.²⁰ This starting point
constitutes the basis for the subsequent calculation, in which all
circumstances of the case are taken into account and weighed, resulting in the final amount of the
fine to be imposed on the controller or processor.”
“(48) The EDPB considers that three elements constitute the starting point
for the subsequent calculation: the categorization of infringements according to their
nature pursuant to Article 83(4) to (6) of the GDPR, the gravity
of the infringement (as explained in Section 4.2), and the company’s
of the enterprise as a relevant factor to be taken into account with a view to
imposing an effective, dissuasive, and proportionate fine, in accordance with
Article 83(1) of the GDPR. These are described in Chapters 4.1, 4.2,
Chapters 4.1, 4.2, and 4.3 are as follows:
- 4.1. Reference to the limits established in paragraphs 4, 5, and 6
of Article 83(2) of the GDPR. Maximum limits and criteria for turnover
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 21/49
- 4.2. Determination of the severity of the infringement, which includes:
o 4.2.1 — Nature, gravity, and duration of the infringement
(Art. 83.2.a)
o 4.2.2 — Whether the infringement was intentional or negligent
(Art. 83.2.b)
o 4.2.3 — Categories of data affected (Art.
83.2.g)
Thus, it cannot be considered that in assessing these circumstances,
an “aggravating factor” is being applied or, in general, that liability is being increased, but rather
that the initial amount of the fine is being determined, in light of the criteria
established in the Guidelines on Fines
- Intent or negligence in the violation (Article 83.2.b). Recital.
VODAFONE argues in this section that negligence cannot be determined on
the basis that a processor has not adopted the security measures
referred to in the Initial Agreement. It then lists
the measures adopted that would demonstrate the exercise of the
required in this regard: (…)
We have already ruled on all of them, except for one. VODAFONE argues
(…).
With regard to the ISO 27001 standard, it should first be noted that the mere
possession of a certification of compliance with the ISO 27001 standard does not
imply adequate compliance with data protection regulations. It
is a standard for compliance with information security management
regulations, which does not imply a management approach aimed at guaranteeing
the rights and freedoms of data subjects, but rather on the security
of information within an organization. Furthermore, this cannot negate the
fact that the breach of confidentiality ultimately occurred, which is not
mitigated by possession of the standard’s certificate.
In contrast, ISO 27701 is an international standard that provides
a framework for information privacy management, expanding upon
the ISO 27001 standard on information security management systems.
It functions as an information privacy management system and helps
organizations comply with regulations such as the GDPR.
Regarding this allegation, on the one hand, VODAFONE does not provide
any proof of the alleged certification. Furthermore, it should be noted that
the breach did not occur due to the operation of the application itself, but rather due to the
improper configuration of access rights established by the
processor. In any case, the breach ultimately occurred, so it is not
it is not possible to take this certification (which, moreover, is unsubstantiated) into account.
- The categories of data affected (Art. 83(2)(g) GDPR). VODAFONE’s
claim contains two assertions. First, that neither the
first and last names nor the email addresses are personal data
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 22/49
that, by its nature, is “particularly sensitive in relation
to fundamental rights and freedoms.” On the other hand, that, in any
case, out of the total number of data subjects affected ((...)), there were 13,020 cases in which the
first and last names were affected. Consequently, there were 46,200 cases
(the majority) in which only the email address was affected.
As explained above, the type of data affected is a factor
that may be taken into account—not as an aggravating or mitigating circumstance—but for the
determination of the initial amount of the penalty. For these purposes, the
corresponding legal basis justifying the amount of the
fine for the violation of Article 5.1.f) details the types of data
affected by the violation.
- Previous violations committed by the same entity (Article 83.2.e) of the
GDPR). VODAFONE points out that the two prior enforcement proceedings
against VODAFONE cited in the decision to initiate proceedings to apply the
The aggravating factor of recurrence would not be valid for these purposes. It asserts that the
previous incidents constituted isolated errors very different from the widespread
breach analyzed in this proceeding.
In this regard, the respondent considers that “the principle of recidivism
requires, for its legitimate application, that the prior violations be of the
same nature or have an objective connection, and that there be evidence of
continuous or repeated conduct, rather than merely isolated incidents
over time.”
An analysis of the precedents reveals that they were as follows:
o PS/00538/2021. VODAFONE was sanctioned for violating
Articles 5.1.f) and 32 of the GDPR. With regard to the first of these articles,
it was established that VODAFONE disclosed the complainant’s
telephone number to a third party, thereby allowing that party to access certain
personal data belonging to the complainant. Additionally, regarding Article 32, the
proceedings established that there were no adequate security measures
in place in the procedures for assigning phone numbers to
customers.
or PS/00164/2022. VODAFONE is also sanctioned under the
same two articles. This enterprise disclosed information about the
complainant to a third party, thereby allowing that third party access to
the complainant’s personal data. The decision found a breach of
confidentiality (Art. 5.1.f) as well as a lack of security measures.
In both proceedings, VODAFONE acknowledged its responsibility for the
facts. From the outset, it was clear that the sanctions were imposed precisely for
the same violations as in the present enforcement proceeding:
a breach of the principle of confidentiality under Article 5.1.f) and a lack of
security measures under Article 32 of the GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 23/49
Having analyzed the aforementioned EDPB Fine Guidelines, it specifically examines
this aggravating factor. It reviews the two circumstances to be taken into account:
o The time period during which the violations occurred. The Guide
does not specify maximum time periods but establishes the principle that
the more recent the violations, the more relevant they are. In
this case, the violations in question were penalized in the years 2021–
2022, which does not allow us to conclude that they are too distant in the past.
o Nature of the violations. Paragraph 88 of the Guidelines states that:
“Although all prior violations may
provide an indication of the general attitude of the controller or
processor with respect to compliance with the
GDPR, violations involving the same subject matter should be given greater
weight, as they are more closely related to the violation currently
under investigation.”
This provision would be fully met in this case, since the
precedents relate to the principle of confidentiality and security
measures.
In light of these circumstances, this Agency considers it important that the penalties
imposed be already final under administrative proceedings. This is
undoubtedly the case here, since, by invoking the reductions in the
amount established in Article 85 of Law 39/2015, VODAFONE
acknowledged its liability in both proceedings.
- The offender’s connection to the processing of personal data (Article
76.2.b) of the LOPDGDD). VODAFONE disagrees with the application of the (this time, indeed)
aggravating factor taken into consideration. This is for the same reasons as those
stated in the argument regarding the amount of the penalty for the violation of
Article 28. Therefore, we refer to that response, as the grounds for rejection expressed therein are fully
applicable to this violation.
- Other circumstances to be taken into account. VODAFONE believes that
the circumstance provided for in Article 83(2)
c) of the GDPR should be taken into account as a mitigating factor: “any measures taken by the controller or processor
to mitigate the damage suffered by the data subjects.”
It asserts that ***ENTERPRISE.1 and VODAFONE adopted measures aimed at
mitigating the effects of the infringement and, thereby, the potential damages that
the data subjects might have suffered.
With regard to this potential mitigating factor, paragraphs 75–76 of the Fine
Guidelines state the following:
“The adoption of appropriate measures to mitigate the damages
suffered by the data subjects may be considered a mitigating factor that
reduces the amount of the fine.” (point 75)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 24/49
Measures implemented voluntarily before
the controller or processor becomes aware of the initiation
of the supervisory authority’s investigation are more likely to be considered a
mitigating factor.” (point 76)
With regard to this argument, it is necessary to analyze the wording of the potential
mitigating factor, both in the GDPR and in the Guidelines on Fines. Reference is made to the
adoption of measures to “mitigate the damage suffered by the
data subjects.” In contrast, VODAFONE emphasizes measures “to
maintain service provision and prevent future incidents.” However laudable
such action may be, it cannot be concluded that the prevention of future incidents
mitigates or alleviates the harm resulting from the loss of control over their
personal data.
THIRD: Violation of Article 32 of the GDPR
Regarding the violation of this article, VODAFONE structures its
arguments into four sections
Alleged Violation in the Notice of Proceedings
Although this is an introductory section of its arguments, at the end of it,
VODAFONE states that “if Articles 5(1)(f) and 32 of the
GDPR (which is not the case), we would be dealing with a single violation, and the alleged lack of
appropriate technical and organizational measures should be understood as falling under, as
a means of commission, the violation of the principle of integrity and confidentiality.”
Regarding this point, it must be noted that, as early as the decision to initiate proceedings,
the distinction between the charges for both violations has been made clear. Thus, in the
violation of Article 5.1(f) (principle of confidentiality), the sanction is imposed because the
absence or inadequacy of certain measures produced a result, namely the
loss of confidentiality of the personal data. That is, the measures were
directly related to that loss. By contrast, the violation of
article 32 is penalized due to the lack of basic security measures in the processing,
even if these measures were not the cause of the loss. The occurrence of a
result is not required; rather, the obligation under Article 32 is characterized as an “obligation of
means.” The absence of security measures constitutes a risk to rights
and freedoms, and must be penalized under that article of the GDPR.
In fact, specific basic measures are mentioned that were not adopted and that
were unrelated to the breach that occurred.
This was already indicated in the agreement to initiate proceedings. In the charge under Article 5.1.f):
“In addition to the foregoing, both the breach notification submitted by the
respondent and the information and documentation provided during the
preliminary investigation proceedings, it has become evident that the
technical and organizational measures were insufficient, which allowed for the
confidentiality of the personal data being processed to be compromised.”
And in the charge under Article 32:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 25/49
“It is important to note that for the obligation
set forth in Article 32 to be considered breached, it is not necessary for a
data breach of personal data to occur or for unauthorized access to the data to take place. The
breach can be deemed to have occurred from the moment adequate security measures
commensurate with the risk have not been adopted, which implies a
situation of structural vulnerability in the processing. Therefore, the absence or
insufficiency of technical and organizational measures proportional to the risk
constitutes in and of itself a violation of Article 32, and is independent of
any breach that may have occurred.”
Security measures challenged in the initiation decision.
absence is highlighted in these proceedings.
First, the lack of control over the geographic origin of the connections.
It indicates that the attack originated in the United States, where the
processor ***ENTERPRISE.1 is headquartered. Thus, such control would not have
been effective.
In this regard, we refer to what has just been clarified regarding the
breach of the obligation to establish security measures, as provided for in
Article 32. Regardless of the origin of the attack in this data breach, the
fact remains that this measure was not in place. (As the
respondent implicitly acknowledges in making this complaint.) This control allows for the rejection of connections
that clearly do not correspond to legitimate access to applications and
systems, especially considering that many cyberattacks originate
from countries with no connection whatsoever to the legitimate source of the connections. The
absence of this measure poses a high risk that can be easily avoided
by implementing it. And the fact is that VODAFONE did not have it in place.
Second, it asserts that, with regard to the expiration of passwords for
access, this was indeed established, referring to the corresponding clause in the
data processing agreement.
Indeed, in the data processing agreement, under the section titled “Management of
Identification and Access,” the provider is required to establish a
90-day expiration period for passwords.
In this regard, it must first be clarified that the data processing agreement
cannot be considered validly entered into until a date after the breach on
September 6, 2024. This issue, as previously stated, is the subject of a charge for
violation of Article 28 of the GDPR. When the breach occurred, the agreement could not
be considered in force. Only on this basis can the claim be rejected
However, in addition, VODAFONE’s response to the AEPD inspector includes
the measure establishing an expiration period for passwords among the
measures to be implemented following the breach, which confirms that it
had not been in place prior to the breach.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 26/49
Liability of the processor.
This section notes that the processor deviated from the
instructions provided by VODAFONE. This relates to two specific aspects.
First, the password expiration policy, on which we have already ruled. The
second is the failure to remove from the domain controller those Users who no longer
need access to the application.
Regarding the latter, it is noted that the measure would be included in the
data processing agreement (section 6.4). However, this is subject to two important conditions, which
have already been extensively discussed. First, the data processing agreement could not
be considered validly entered into at the time the
breach occurred. And second, that this would not preclude VODAFONE’s liability,
since it has not been proven that the processor processed
the personal data for its own purpose.
Therefore, the argument must be dismissed.
Absence of fault.
VODAFONE considers that the charge would violate the principle of culpability, and
refers to the corresponding argument made in relation to Article 5.1.f). We also
refer to our response to that argument.
Circumstances for determining the amount.
It argues regarding the “aggravating factors” that were allegedly taken into account in the
proceedings, and proposes mitigating factors to reduce the amount.
- Nature, gravity, and duration of the violation (Article 83(2)(a) of the GDPR).
VODAFONE considers that under no circumstances would the violation have
“systemic implications”—that is, implications that could be extrapolated to other data subjects—but rather
that it stems from specific events caused by an incident experienced by
a processor.
It should be noted that the initial agreement in no way makes any
extrapolation, nor does it indicate that systemic deficiencies are involved. However,
when determining the severity and scope of the infringement, it takes into
consideration that the infringement (…). This factor is taken into account when
determining the amount of the fine, but no extrapolation is made in relation to
other data subjects or groups.
- Degree of intent or negligence in the violation (Article 83(2)(b) of the
GDPR). Here, VODAFONE raises two objections regarding the fact that
negligence was considered serious. First, the security measures
whose absence is alleged were either already in place or could not
be considered basic. It refers to the arguments already
presented. Similarly, we must refer to what has already been responded to
previously.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 27/49
Second, contrary to what is asserted in this regard in the
decision to initiate proceedings, VODAFONE did carry out audit and control activities (those
already mentioned on 12/22/2022 and 03/30/2023).
In this regard, we should also refer to the response to the allegation that
these activities were carried out. As noted, these are
documents that do not detail the methodology or working procedure;
they merely list a series of principles and objectives, without
, and which listed as already implemented measures that were later
found not to have been implemented.
Thus, the conclusion remains valid that the controller
merely carried out a formal compliance check on the processor,
without detecting the problems that existed.
- Any prior violations committed by the offender. VODAFONE makes the same
argument as in Article 5.1.f), to which we refer for our response.
That response is valid for both that article and this article
32, since the precedents cited covered both violations.
IV
Arguments Presented in Response to the Proposed Resolution
Since the brief of arguments regarding the proposed resolution largely reiterates
those already set forth in the arguments concerning the decision to initiate proceedings, we refer in
general to the response already provided, without prejudice to certain
observations and adjustments set forth below.
FIRST: Violation of Article 28 of the GDPR
VODAFONE reiterates in its statement of defense that it has not infringed Article 28 of the
GDPR:
In response, we reiterate that, according to the documentation and arguments
submitted by the defendant, there is evidence of a contract signed on
September 6, 2024, and that it includes a reference stating that it entered into force
on December 22, 2022. However, the only evidence of the contract’s execution would be the
signature (which guarantees the parties’ participation, knowledge, and consent) by the
parties to the contract. Thus, VODAFONE has not proven that the contract was validly
entered into prior to the date of signature recorded in the documentation on file,
namely, December 22, 2022.
Regarding the 20% reduction, to which VODAFONE also refers,
we note that the reduction in the amount initially stated in the initial agreement
was due to the following:
“Since the initial agreement cited the particular severity of the fact that the
ID number had been compromised, when in reality this is not the case, the amount of the
penalty for the violation of Article 28 of the GDPR is reduced, as explained below, in the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 28/49
corresponding legal basis for this proposal (Section XIII “Proposed
Penalty for Non-Compliance with Article 28 of the GDPR”).
It is unclear what connection is implied, upon reading the arguments, between the
invalidity of the data processing agreement and the 20% reduction in the fine on the grounds that
the ID number was not affected by the data breach.
I. The data processing agreement was in effect on the date of the incident
VODAFONE states that “the data processing agreement existed and was binding on the parties as early as
December 2022. The document titled ‘Service Agreement’ simply
set forth in writing the agreement reached between VODAFONE and ***ENTERPRISE.1, which
had been binding on them since December 27, 2022.”
(…)
“Thus, regardless of the date the written document was signed, the existence
of the data processing agreement under the terms required by Article 28.3 of the GDPR, prior
to the commencement of processing operations, is substantiated in the record:
a) On page 60, there is an email from A.A.A., the responsible employee at
***ENTERPRISE.1, addressed to several corporate email addresses of
VODAFONE employees, including DPO-SPAIN@VODAFONE.es (…)
b) On page 94 is a risk analysis dated December 22, 2022, based on
the VODAFONE Group’s minimum security requirements, which, as a reminder,
***ENTERPRISE.1 committed to complying with as of December 27, 2022.
c) On page 174 of this file is the security analysis conducted by
VODAFONE following the December 2022 risk analysis, in which
the measures identified as partially
compliant (“Partially in place”) were tracked to review their implementation by
***ENTERPRISE.1.
As can be seen, VODAFONE’s arguments substantially mirror
those already presented in response to the notice of initiation, to which we refer.
We would simply like to point out that, according to the case file, the date of signature of the
data processing agreement was September 4, 2024—that is, 1 year and 9 months after the agreement reached
that VODAFONE cites (December 2022). A period during which, had
no agreement been reached with the processor, the processing
of personal data that had taken place would have lacked legal basis. In this regard, the signing
of a data processing agreement—when, in practice, such processing is actually being
carried out by a processor—cannot be subject to
the discretion of the controller in deciding when to formalize it; rather, it must
precede the actual performance of the contract because, precisely, this performance is
carried out in accordance with the terms of the contract. And, for this reason, it provides a guarantee
both for the controller—who has clearly set forth the instructions that the processor must
follow in performing the data processing agreement—and for the processor
themselves—who can demonstrate, in accordance with the instructions received, that they have
complied with the terms of the agreement.
a VODAFONE provides an email, in English, sent by someone
who claims to be a data controller at ***ENTERPRISE.1 addressed to several employees at
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 29/49
VODAFONE, as well as to its DPO, regarding an incident. The date of the email is
11/20/2023.
Part of the email is reproduced below due to its relevance (unofficial translation):
b “Subject: Confidential/Personal Data Issue at ***ENTERPRISE.1
c “I would like to update you on an incident that has recently come to light
.
d
e ***ENTERPRISE.1 became aware of allegations of unauthorized access,
along with screenshots of allegedly compromised data, which were
shared online. Two sample data files were also published online
by the threat actor. We immediately initiated a response to the
incident and began an investigation.
0 (…)
f Although the investigation is still ongoing, we have no reason to believe that the
issue affects your network services or extends beyond the identified
third-party services.”
0 (…)
1 “Thank you for your patience. We will share more information as it becomes
relevant. Please do not hesitate to contact us.”
2
In light of the email’s content, it appears to be a notification to VODAFONE
regarding a data incident/breach suffered by ***ENTERPRISE.1, pursuant to Article 34.1
of the GDPR, “where the personal data breach is likely to result in a high risk
to the rights and freedoms of natural persons, the controller shall communicate the
breach to the data subject without undue delay,”
,” and to which reference was made in the first Background section.
Furthermore, VODAFONE states regarding the aforementioned email that “in this email, the
employee of ***ENTERPRISE.1 informed this party’s employees, including its
DPO, of a security breach and its impact.”
The email in question cannot be considered proof that the date of the
service agreement was December 27, 2022.
With regard to the risk analysis dated December 22, 2022, based on the
minimum security requirements of the Vodafone Group and the aforementioned security analysis,
we refer to what has already been stated in the proposed resolution on this matter.
Notwithstanding the foregoing, and given that the actual signing of the contract has been
duly substantiated, the AEPD views this measure favorably and
takes it into account in determining the amount of the fine imposed for the
violation of Article 28 of the GDPR.
SECOND: Infringement of Article 5.1.f) of the GDPR
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 30/49
VODAFONE expresses its disagreement, as it considers that the
liability arising from the loss of data confidentiality does not rest with
VODAFONE
In support of its claim, VODAFONE submits Document No. 1, titled “ENCRYPTION
GUIDELINES- ***ENTERPRISE.2,” an unsigned document in English dated June 1, 2023,
a portion of which is reproduced below due to its relevance (unofficial translation):
OVERVIEW
“Cryptographic controls are applied throughout the ***ENTERPRISE.2 ‘stack’
to provide significant security. Many of these
controls are complex to implement or audit, and subtle errors
can lead to catastrophic failures.
This document provides best practices to minimize the
risk at ***ENTERPRISE.2 and guide employees in making
secure decisions with ease.”
2. SCOPE
“These guidelines apply to all team members,
contractors, and vendors. All team members are expected to
understand and apply the guidelines.”
The aforementioned document would establish guidelines for making
secure decisions, but at no point does it mention that the
data pertaining to VODAFONE is encrypted.
VODAFONE again refers to two analyses conducted by VODAFONE’s
information security team, which were addressed in the proposed resolution and
referred to therein.
It should also be noted that the alleged encryption of the information that VODAFONE
seeks to assert is inconsistent with the fact that the data exfiltrated during the
attack was for sale on the internet, which demonstrates, in our view, that the
confidentiality of the data was compromised.
VODAFONE reiterates that the data processing agreement had been in effect since
December 27, 2022, and that said agreement included detailed information on security
measures, compliance with which by the data processor would have prevented the incident.
Regarding the validity of the contract and the potential liability of the processor, we refer to our previous statements. However, in
determining the penalty, we take into account the fact that the data processing agreement,
which included technical and organizational measures designed to safeguard the
confidentiality of the data, was formalized, albeit after the incident occurred.
VODAFONE reiterates that its conduct does not involve any fault whatsoever,
neither by willful misconduct nor by negligence, and therefore the imposition of a
penalty would not be warranted; furthermore, it acted with the due diligence required of it.
In this regard, we highlight what was already indicated in the proposed resolution:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 31/49
In any case, with regard to the principle of culpability, the Supreme Court ruling of October 17, 2007 (Case No. 63/2006) is fully
applicable to this case, which,
after noting that entities whose
activities involve the continuous processing of customer and third party data
must observe an adequate level of diligence, states:
“[...] the Supreme Court has consistently held that negligence exists whenever
a legal duty of care is disregarded; that is, when the offender
fails to act with the required diligence. And in assessing the degree of
diligence, special consideration must be given to whether or not the
party in question acts professionally, and there is no doubt that, in the case now under review, since the
appellant’s activity involves the constant and extensive handling of
personal data, there must be an emphasis on rigor and the utmost care to
comply with the relevant legal provisions.”
Furthermore, the National Court, in matters of
personal data protection, has stated that “simple negligence or
failure to comply with the duties imposed by law on persons
responsible for filing systems or data processing is sufficient to require the
“Under these circumstances, this party considers that the fact that particularly sensitive data
as the national ID number affects the nature and categories
of the processing, which are key elements for quantifying a
data protection penalty. For this reason, and given that the Agency reduced the
penalty for the violation of Article 28 of the GDPR from 250,000 euros to
200,000 euros (i.e., a 20% reduction), it is appropriate to
also apply a reduction to the penalty corresponding to the violation of
Article 5.1(f) of the GDPR.”
In this regard, it should be noted that the section referring to the categories of data
affected by the infringement (Article 83(2)(g) of the GDPR) states: the leakage of
basic personal data such as email addresses, associated with the corresponding first
and last names. In other words, no reference is made to the national identification number (DNI), and therefore
this claim must be dismissed.
THIRD: Violation of Article 32 of the GDPR
VODAFONE asserts that it has not violated Article 32 of the GDPR and bases this
on arguments that reiterate those already raised in connection with the agreement to initiate
the present proceedings, to which a response was already provided in the proposed
resolution issued.
That said, it again asserts that liability for the violation
of Article 32 of the GDPR would not fall on VODAFONE but on the processor.
As we have noted, this argument has already been duly addressed in the
draft resolution phase. However, given that the measures whose absence is
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 32/49
are included in the data processing agreement—although this agency acknowledges their legal validity
only after the events that are the subject of these proceedings—this
fact is taken into account when assessing the penalty to be imposed for the commission
of this violation.
The remaining arguments raised regarding this violation have already been
duly addressed in the proposed resolution, to which we refer.
IV
Breach of Obligation. Integrity and Confidentiality
Article 5.1(f) of the GDPR
1. Regulatory Reference and Breach Occurred
Article 5.1(f) of the GDPR states:
“1. Personal data shall be:
(…)
(f) processed in a manner that ensures appropriate security of the personal data,
including protection against unauthorized or unlawful processing and against
accidental loss, destruction, or damage, through the implementation of appropriate technical
or organizational measures (“integrity and confidentiality”).”
In the present case, a data breach involving personal data has occurred. According to the
available information, including the notification of this breach to the AEPD by
VODAFONE regarding said breach, the information obtained during the
preliminary investigation conducted, and in accordance with the established facts of
this decision, it is evident that on November 20, 2023, a VODAFONE supplier
(***ENTERPRISE.1) reported a security incident that affected a file
containing VODAFONE customer data. The affected customers (…)
were able to download a file containing VODAFONE customer data.
The person in charge stated that: “***ENTERPRISE.1 is a VODAFONE supplier (…).
To provide these services, ***ENTERPRISE.1 (…). A copy of the email
sent to VODAFONE on November 20, 2023, is attached.
According to the communication sent by ***ENTERPRISE.1 to VODAFONE, (…).
The fourth established fact details the type and number of affected individuals, which can
be summarized as the first and last names of a total of (…) customers
The source of the breach was unauthorized access, using legitimate credentials, to one
of the systems used by the provider to provide services to the data controller, and the
details are contained in the fifth established fact:
The description of the cause of the breach itself reveals deficiencies regarding
the technical and organizational measures that led to it: the tool
***ENTERPRISE.2 (…).
These deficiencies are evident in VODAFONE’s response to the request
for information from this Agency’s inspection.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 33/49
Therefore, with regard to the lack of technical and organizational measures that led
to the loss of confidentiality of the personal data of VODAFONE customers,
the following observations are made:
(…)
Their absence must be considered a failure to implement a basic measure to
protect the integrity and confidentiality of personal data
- (…)
In addition to the above, both the breach notification submitted by the
respondent and the information and documentation provided during the
preliminary investigation, the inadequacy of the technical
and organizational measures has become evident, which allowed the confidentiality
of the personal data being processed to be compromised.
Thus, in VODAFONE’s response to this Agency’s request, it cites
(…) as one of the subsequent measures.
Finally, it must be noted that VODAFONE, as the controller, has provided no information regarding the potential oversight measures it
would implement to ensure that its processor complies
with the required measures. Although the data processing agreement provides for the
possibility that the controller may conduct audits of
the processor’s compliance, the controller has provided no information regarding this
aspect; thus, the controller merely formally imposed the obligations
without supervising whether they were actually being met.
All of these factors provide sufficient evidence to conclude that, at the
time the breach occurred, the respondent had not implemented
appropriate technical or organizational measures in place to ensure adequate
security of personal data, including protection against unauthorized
or unlawful processing and against accidental loss, destruction, or damage.
Articles 5(2) and 24 of the GDPR impose general obligations of accountability and compliance on the
controller of personal data. These
provisions require the controller to adopt appropriate measures aimed at
preventing possible violations of the rules established by the GDPR, in order to
guarantee the right to data protection
Therefore, in accordance with the established facts of this decision, it is
considered that the known facts constitute an infringement attributable to
VODAFONE for violating Article 5.1.f) of the GDPR, as transcribed above.
V
Classification of the violation of Article 5(1)(f) of the GDPR and determination for purposes of
the statute of limitations
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 34/49
Article 83.5 of the GDPR classifies as an administrative violation the breach of the
following articles, which shall be penalized, in accordance with paragraph 2, with administrative fines
of up to 20,000,000 EUR or, in the case of an enterprise,
an amount equivalent to a maximum of 4% of the total annual
global turnover for the preceding financial year, whichever is higher:
“a) the basic principles governing processing, including the conditions for
consent as set forth in Articles 5, 6, 7, and 9;”
For its part, article 71 of the LOPDGDD, “Violations,” states that:
“Acts and conduct referred to in
paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those
that are contrary to this Organic Law.”
For the sole purpose of the statute of limitations, Article 72.1 of the LOPDGDD
provides as follows:
“Pursuant to Article 83(5) of Regulation (EU) 2016/679,
, infringements that
constitute a substantial violation of the articles mentioned therein—and,
in particular, the following—shall be considered very serious and shall be subject to a three-year statute of limitations:
a) The processing of personal data in violation of the principles and safeguards
set forth in Article 5 of Regulation (EU) 2016/679.”
VI
Penalty for noncompliance with Article 5.1.f) of the GDPR
In order to determine the administrative fine to be imposed, the
provisions of Articles 83(1) and 83(2) of the GDPR must be observed, which state:
“1. Each supervisory authority shall ensure that the imposition of administrative fines
pursuant to this article for the infringements of this
Regulation referred to in paragraphs 4, 9, and 6 is, in each individual case,
effective, proportionate, and dissuasive.
2. Administrative fines shall be imposed, depending on the circumstances of each
individual case, in addition to or in lieu of the measures referred to in
Article 58(2)(a) through (h) and (j). When deciding whether to impose an
administrative fine and its amount in each individual case, due consideration shall be given to:
(a) the nature, gravity, and duration of the violation, taking into account the
nature, scope, or purpose of the processing operation in question, as well
as the number of data subjects affected and the extent of the damages they
have suffered;
b) whether the violation was intentional or due to negligence;
c) any measures taken by the controller or processor to
mitigate the damages suffered by the data subjects;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 35/49
d) the degree of responsibility of the controller or processor,
taking into account the technical or organizational measures they have implemented pursuant
to Articles 25 and 32;
e) any previous violations committed by the controller or processor;
f) the extent of cooperation with the supervisory authority to remedy the
violation and mitigate its potential adverse effects;
g) the categories of personal data affected by the breach;
h) the manner in which the supervisory authority became aware of the breach, in
particular whether the controller or processor notified the supervisory authority of the breach and, if so, to what
extent;
i) where measures referred to in Article 58(2) have previously been ordered
against the controller or processor concerned in relation to the
same matter, compliance with those measures;
j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms
certification mechanisms approved pursuant to Article 42, and
k) any other aggravating or mitigating factors applicable to the circumstances of the case,
such as financial benefits obtained or losses avoided, directly or
indirectly, through the violation.”
For its part, article 76, “Penalties and Corrective Measures,” of the LOPDGDD
provides:
“1. The penalties provided for in paragraphs 4, 5, and 6 of article 83 of the Regulation
(EU) 2016/679 shall be applied taking into account the criteria for determining the level of the sanction
set forth in paragraph 2 of the aforementioned article.
2. In accordance with the provisions of Article 83(2)(k) of Regulation (EU) 2016/679,
the following may also be taken into account:
a) The ongoing nature of the violation.
b) The connection between the violator’s activity and the processing of
personal data.
c) The profits obtained as a result of the violation.
d) The possibility that the data subject’s conduct may have contributed to the commission
of the violation.
e) The existence of a merger by absorption occurring after the commission of the
violation, which cannot be attributed to the absorbing entity.
f) The impact on the rights of minors.
g) Having a data protection officer, where such a position is not mandatory.
h) The voluntary submission by the controller or processor to
alternative dispute resolution mechanisms in cases where
disputes exist between them and any data subject.”
In the present case, with regard to the seriousness of the possible violation,
with particular regard to the consequences it has on those affected,
a fine should be imposed, in addition to the adoption of measures, if
appropriate.
The fine imposed must, in each individual case, be effective, proportionate, and
deterrent, in accordance with the provisions of Article 83(1) of the GDPR. It is hereby decided,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 36/49
as a preliminary matter, VODAFONE’s annual revenue to be €2,909,851,000
for the year 2024.
For the purposes of deciding on the imposition of an administrative fine and its amount,
in accordance with the established facts, it is considered appropriate to determine the penalty to
be imposed in accordance with the following circumstances, as set forth in the
provisions cited above.
• The nature, gravity, and duration of the violation, taking into account the
nature, scope, or purpose of the processing operation in question,
as well as the number of data subjects affected and the extent of the damages
they have suffered (Article 83(2)(a) of the GDPR).
With regard to severity, it should be noted that this is a widespread
data breach involving VODAFONE customer data, resulting from
a cyberattack that allowed for the exfiltration and publication of the compromised filing systems
compromised files, including enterprise customers, self-employed individuals, and
private individuals. In this regard, the number of data subjects affected, as detailed in
the background of this proposed resolution, amounts to a total of (...)
affected individuals.
• Intent/Negligence in the violation (Article 83(2)(b) of the
GDPR): serious negligence is deemed to have occurred, given Recital 83(2)(b)
that the controller’s conduct reveals a serious lack of diligence,
as it failed to implement the minimum operational controls required in the course of its
activities. The absence of an adequate authentication system and the lack of
encryption do not stem from a one-time error or an accidental circumstance, but rather from
the ongoing management of the environment without addressing the risks inherent in
the processing of personal data. This type of structural oversight does not
constitute an isolated technical failure, but rather an indicator of a systematic failure to
pay attention to the most basic aspects of protection, which allows
the conduct to be classified as gross negligence for the purposes of determining
the penalty, distinguishing such conduct from the primary offense.
• The categories of data affected by the
infringement (Article 83(2)(g) of the GDPR). The leak of basic personal data
such as email addresses, associated with the corresponding first and
last names.
Likewise, the following factors are considered as
aggravating circumstances for determining the penalty:
• Any prior infringement committed by the controller or processor
(Article 83(2)(e) of the GDPR): penalty proceedings
PS/00164/2022 and PS/00538/2021 (both for violations of Article 5.1(f) of the
GDPR)
The first of these (PS/00164/2022) sanctions VODAFONE for violating
the principle of confidentiality of personal data by disclosing to a third party
information about another customer of the operator (name, national ID number, and
phone number). The second (PS/00538/2021) also imposes a penalty for the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 37/49
same violation, by assigning a telephone number that belonged to
the complainant to a customer.
• The link between the violator’s activity and the processing
of personal data (Article 76.2(b) of the LOPDGDD). On
On the one hand, the offender’s main activity involves offering services to
the general public and attracting a large number of customers who are
natural persons. Therefore, the ongoing processing
of their customers’ personal data is an essential part of their activity. On the other hand, the systems targeted by the
attack in this case relate to the marketing of the
operator’s services; thus, they are also specifically linked to the routine
processing of personal data.
In addition, the following aggravating factor is considered a mitigating circumstance
pursuant to Article 83(2) of the GDPR:
- Any measures taken by the controller or processor to
mitigate the damage suffered by the data subjects (Article 83(2)(c)
of the GDPR): it is established in this case that VODAFONE’s contract for
the processing of personal data—although legally valid only after the events occurred—includes
technical and organizational measures designed to ensure the confidentiality of the
data being processed.
A balance of the circumstances set forth in Article 83(2) of the GDPR and Article 76(2) of
the LOPDGDD, with respect to the violation committed by breaching the provisions of
Article 5(1)(f) of the GDPR, allows for the imposition of an administrative fine of
FIVE HUNDRED THOUSAND EUROS (€500,000).
VII
Article 32 of the GDPR
Failure to comply with an obligation. Security of processing
Article 32 of the GDPR stipulates the following:
“1. Taking into account the state of the art, the costs of implementation, and the
nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of risks to
the rights and freedoms of natural persons
, the controller and the processor shall implement appropriate technical and
organizational measures to ensure a level of security appropriate to the risk,
which, where applicable, shall include, among others:
a) the pseudonymisation and encryption of personal data;
b) the ability to ensure the confidentiality, integrity, availability, and resilience
of processing systems and services;
c) the ability to restore the availability of and access to personal data
promptly in the event of a physical or technical incident;
d) a process for regularly verifying, evaluating, and assessing the effectiveness of the
technical and organizational measures to ensure the security of the processing.
2. When assessing the adequacy of the level of security, particular consideration shall be given to
the risks posed by the processing of personal data, in particular as a
consequence of the accidental or unlawful destruction, loss, or alteration of data
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 38/49
transmitted, stored, or otherwise processed, or the unauthorized disclosure or
access to such personal data.
3. Adherence to a code of conduct approved pursuant to Article 40 or to a
certification mechanism approved pursuant to Article 42 may serve as evidence
of compliance with the requirements set forth in paragraph 1 of
this article.
4. The controller and the processor shall take measures to ensure that
any person acting under the authority of the controller or the processor and
having access to personal data may process such data only on
instructions from the controller, unless required to do so under the law of
the Union or of the Member States.”
The documentation in the case file provides evidence of a violation of
Article 32(1) of the GDPR, due to the absence of security measures in the processing of
VODAFONE customers’ personal data (…)”
It should be noted that the GDPR, in the aforementioned provision, does not establish a list of
security measures that are applicable based on the data being
processed, but rather stipulates that the controller and the processor
shall implement technical and organizational measures appropriate to the risk posed by
the processing, taking into account the state of the art, the costs of implementation, the
nature, scope, context, and purposes of the processing, and the risks—in terms of likelihood
and severity—to the rights and freedoms of the data subjects.
Likewise, security measures must be appropriate and proportionate to the
identified risk, noting that the determination of technical and
organizational measures must take into account: pseudonymisation and encryption, the
ability to ensure confidentiality, integrity, availability, and resilience, the
ability to restore availability and access to data following an incident, and the process
of verification (as distinct from auditing), evaluation, and assessment of the effectiveness of the
measures.
In any case, when assessing the adequacy of the security level in relation to the risk,
particular consideration shall be given to the risks posed by data processing, such as
resulting from the accidental or unlawful destruction, loss, or alteration of
personal data transmitted, stored, or otherwise processed, or the unauthorized disclosure of or
access to such data, which could cause physical, material, or non-material
damage or harm.
In this regard, Recital 83 of the GDPR states that:
“(83) In order to maintain security and prevent the processing from infringing the provisions of
this Regulation, the controller or processor must assess the risks
inherent in the processing and implement measures to mitigate them, such as encryption. These
measures must ensure an appropriate level of security, including
confidentiality, taking into account the state of the art and the cost of implementation
in relation to the risks and the nature of the personal data to be
protected. When assessing risk in relation to data security, one must
take into account the risks arising from the processing of personal data,
such as the accidental or unlawful destruction, loss, or alteration of personal data
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 39/49
transmitted, stored, or otherwise processed, or the unauthorized disclosure of or access to
such data, which may, in particular, result in physical, material, or non-material
damages.”
As Recital 39 also notes:
“…Personal data must be processed in a manner that ensures adequate security and
confidentiality of personal data, including to prevent unauthorized access
or use of such data and the equipment used in the processing
It should be noted that security measures appropriate to the risk are key to
guaranteeing the fundamental right to data protection, since it is not
possible to ensure that right if the confidentiality,
integrity, and availability of personal data cannot be guaranteed. To ensure these security factors,
both technical and organizational measures
that are appropriate are necessary.
It is important to emphasize that for the obligation set forth in
Article 32 to be considered breached, it is not necessary for a data breach of personal data to occur or
for unauthorized access to the data to take place. The violation can be established
from the moment adequate security measures have not been adopted
in accordance with the risk, which implies a situation of structural vulnerability in the
processing. Therefore, the absence or inadequacy of technical and organizational measures
proportional to the risk constitutes in itself a violation of Article 32, and is
independent of any breach that may have occurred.
One of the requirements established by the GDPR for controllers and processors
who carry out processing activities involving personal data is the
need to conduct an information security risk assessment
for the purpose of establishing security and control measures aimed at complying with the
principles of protection by design and by default that guarantee the rights and
freedoms of individuals.
The documentation included in the case file reveals clear deficiencies in the
adoption of security measures, which are basic measures intended to protect
the security of information systems. The following is a list of the
main deficiencies detected through the preliminary investigative actions
carried out by this Agency.
(…)
All of these aspects provide sufficient evidence to conclude that the
respondent had not implemented appropriate technical and organizational security measures
to ensure a level of security commensurate with the risk at the time
of the events.
Therefore, based on the available evidence, it is considered that
the known facts constitute a violation, attributable to VODAFONE,
for breach of the article cited above.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 40/49
VIII
Classification of the violation under Article 32 of the GDPR and determination for purposes of
the statute of limitations
Article 83(4) of the GDPR classifies the violation of the
following articles as an administrative offense; such violations shall be penalized, in accordance with paragraph 2, with administrative fines
of up to 10,000,000 EUR or, in the case of an enterprise,
an amount equivalent to up to 2% of the total annual
global turnover for the previous fiscal year, whichever is higher:
“a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25
through 39, 42, and 43;”
For its part, Article 71 of the LOPDGDD, titled “Infractions,” states that:
“Acts and conduct referred to in paragraphs 4,
5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are
contrary to this Organic Law, constitute violations.”
For the sole purpose of the statute of limitations, Article 73 of the LOPDGDD establishes
the following:
“Pursuant to the provisions of Recital 83(4) of Regulation (EU) 2016/679,
infractions that constitute a substantial breach of the articles mentioned therein, and in particular the
following, shall be considered serious and shall be subject to a two-year statute of limitations:
f) Failure to adopt the technical and organizational measures that are
appropriate to ensure a level of security appropriate to the risk of the processing,
as required by Article 32(1) of Regulation (EU) 2016/679.”
IX
Penalty for Noncompliance with Article 32 of the GDPR
In order to determine the administrative fine to be imposed, the
provisions of Articles 83(1) and 83(2) of the GDPR must be observed, as well as those of Article 76
Of the LOPDGDD, as set forth above.
In the present case, considering the seriousness of the potential violation, with
particular regard to the consequences it has for the data subjects,
a fine should be imposed, in addition to the adoption of measures, if
appropriate.
The fine imposed must, in each individual case, be effective, proportionate, and
deterrent, in accordance with article 83(1) of the GDPR. Accordingly,
VODAFONE’s annual revenue is preliminarily estimated at 2,909,851,000 euros
for the year 2024.
For the purposes of deciding on the imposition of an administrative fine and its amount,
based on the established facts, the penalty to be imposed must be determined in accordance
with the following circumstances, as set forth in the aforementioned provisions.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 41/49
It is considered that the following circumstances exist:
• The nature, gravity, and duration of the violation, taking into account the
nature, scope, or purpose of the processing operation in question, as well
as the number of data subjects affected and the extent of the damages they
have suffered (Article 83(2)(a) of the GDPR).
In this case, the number of data subjects affected must be taken into consideration. It should be
noted that the lack of security measures affects all customers whose
data were processed by the processor. The total number of such data subjects
is (...).
• Intent or Negligence in the Violation (Article 83(2)(b) of the
GDPR). The negligence involved in this violation should be classified as serious.
This is because the missing security measures were of a
basic nature ((…)). All of this, combined with the effective absence of audits of the processing
carried out by the processor, as set forth in the data processing agreement, the legal validity
of which the AEPD recognized after the fact.
• The categories of data affected by the violation (Article
83(2)(g) of the GDPR). All of the basic data
subject to processing is involved, such as email addresses, associated with the corresponding
first and last names.
Furthermore, the following factors are considered as
aggravating circumstances:
• Any prior infringement committed by the controller or processor
(Article 83(2)(e) of the GDPR). The same
precedents cited in determining the amount of the fine under Article
5.1(f), since those cases also imposed penalties for the lack of
security measures in accordance with Article 32: PS/00164/2022 and PS/00538/2021.
The first of these (PS/00164/2022) imposes a penalty on VODAFONE for the lack of
security measures for personal data, resulting in the disclosure to a third party of data belonging to
another customer of the operator (name, national ID number, and phone number). The
second (PS/00538/2021) also imposes a penalty for the same
violation, for assigning a telephone number that belonged to the
complainant to a customer.
• The link between the infringer’s activity and the processing of
personal data (Article 76.2(b) of the LOPDGDD). On the one hand, the
offender’s primary activity involves offering services to the general public
and attracting a large number of customers who are natural persons. Therefore,
the ongoing processing of its customers’ personal data
is an essential part of its activity. On the other hand, the systems targeted in this
case relate to the marketing of the operator’s services, and
as such, they are also specifically linked to the routine processing of
personal data.
Furthermore, the following mitigating factor is considered
pursuant to Article 83(2) of the GDPR:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 42/49
- Any measures taken by the controller or processor to
mitigate the damages suffered by the data subjects (Article 83(2)(c)
of the GDPR): it is established in this case that VODAFONE has adopted measures
aimed at strengthening the security of the processing. Furthermore, although the
data processing agreement entered into after the facts occurred and without evidence
of effective implementation, the agreement provides for the conduct of
periodic audits of the processing carried out by the processor
A balancing of the circumstances set forth in Article 83(2) of the GDPR and Article 76(2) of
the LOPDGDD, with respect to the violation committed by breaching the provisions of
Article 32 of the GDPR, allows for the imposition of an administrative fine of ONE HUNDRED
FIFTY THOUSAND EUROS (€150,000).
X
Article 28 of the GDPR. Failure to comply. Processor
The provisions regarding the processor are set forth in Article
28 of the GDPR, which stipulates the following:
“1. Where processing is to be carried out on behalf of a controller,
, the controller shall select only a processor that provides sufficient guarantees
to implement appropriate technical and organizational measures, so that the
processing complies with the requirements of this Regulation and ensures the
protection of the data subject rights.
2. The processor shall not engage another processor without the prior
written authorization—whether specific or general—of the controller. In the latter case, the processor
shall inform the controller of any planned changes involving the engagement or
replacement of other processors, thereby giving the controller the opportunity to object
to such changes.
3. Processing by the processor shall be governed by a contract or other legal act under
Union or Member State law, which binds the processor
to the controller and sets forth the subject matter, duration, nature, and
purpose of the processing, the type of personal data and categories of data subjects, and the
obligations and rights of the controller. That contract or legal act shall stipulate, in
particular, that the processor:
(a) shall process personal data only on documented instructions from the
controller, including with regard to data transfers to a
third country or an international organisation, unless required to do so under
Union or Member State law applicable to the processor; in
which case, the processor shall inform the controller of that legal requirement prior to
processing, unless such law prohibits it for important reasons of public interest;
(b) ensure that persons authorized to process personal data have
undertaken to respect confidentiality or are subject to a legal obligation of
confidentiality;
(c) take all necessary measures in accordance with Article 32;
d) comply with the conditions set forth in paragraphs 2 and 4 when engaging another
processor;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 43/49
e) assist the controller, taking into account the nature of the processing, through
appropriate technical and organizational measures, whenever possible, so that
the controller may fulfill its obligation to respond to requests aimed at
the exercise of the data subject rights set forth in Chapter III;
f) assist the controller in ensuring compliance with the obligations
set forth in Articles 32 through 36, taking into account the nature of the processing
and the information available to the processor;
g) at the controller’s discretion, shall delete or return all personal data once
the provision of processing services has ended, and shall delete any existing copies
unless the storage of the personal data is required under
Union or Member State law;
h) make available to the controller all information necessary to demonstrate
compliance with the obligations set forth in this article, as well as
to enable and assist in the conduct of audits, including inspections, by
the controller or another auditor authorized by the controller.
With regard to subparagraph (h) of the first paragraph, the processor shall inform
the controller immediately if, in its opinion, an instruction infringes this
Regulation or other data protection provisions of the Union or of
the Member States.
4. Where a processor engages another processor to carry out
certain processing activities on behalf of the controller, the same data protection
obligations as those set forth in the contract or other legal act under
Union or Member State law, the same data protection obligations as
those set forth in the contract or other legal act between the
controller and the processor referred to in paragraph 3, in particular the provision
of sufficient guarantees that appropriate technical and organizational measures will be implemented
so that the processing complies with the provisions of this
Regulation. If that other processor fails to fulfill its data protection obligations,
the original processor shall remain fully liable to the controller
with respect to the fulfillment of the obligations of the other
processor.
5. The processor’s adherence to a code of conduct approved
pursuant to Article 40 or to a certification mechanism approved pursuant to Article
42 may be used as an element to demonstrate the existence of the
sufficient safeguards referred to in paragraphs 1 and 4 of this article.
6. Without prejudice to the conclusion of an
individual contract between the controller and the processor, the contract or other legal act referred to in paragraphs 3 and 4
of this article may be based, in whole or in part, on the
standard contractual clauses referred to in paragraphs 7 and 8 of this article, even
when they form part of a certification granted to the controller or processor
in accordance with Articles 42 and 43.
7. The Commission may establish standard contractual clauses for the matters referred to
in paragraphs 3 and 4 of this article, in accordance with the examination procedure
referred to in Article 93(2).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 44/49
8. A supervisory authority may adopt standard contractual clauses for the
matters referred to in paragraphs 3 and 4 of this article, in accordance with the
consistency mechanism referred to in Article 63.
9. The contract or other legal act referred to in paragraphs 3 and 4 shall be in
writing, including in electronic form.
10. Without prejudice to Articles 82, 83, and 84, if a processor
violates this Regulation by determining the purposes and means of
processing, it shall be considered the controller with respect to such
processing.”
Article 28 of the GDPR imposes the obligation that, in the event an entity is
to carry out personal data processing operations on behalf of another entity that
determines the means and purposes, a contract must be entered into that binds the processor
to the controller and sets forth “the subject matter, duration, nature, and
purpose of the processing, the type of personal data and categories of data subjects, and the
obligations and rights of the controller.”
The purpose is clear: to ensure that the fact that the
processing of personal data is physically carried out by an enterprise other than the
controller—but on the controller’s behalf or at its request—does not result in a
compromise of compliance with GDPR obligations. In this regard, it is
important to note that this entrustment may affect rights and obligations as
significant as the exercise of rights by data subjects; the guarantee of the
data integrity and confidentiality, and the need to establish appropriate
security measures that help ensure these principles (the latter
aspects being particularly relevant in this case).
Therefore, article 28(3) imposes both the obligation to enter into a
contract and the minimum content that it must include. With regard to the
formal conclusion of the contract, it is important to refer to the provisions of paragraph
101 of Guidelines 07/2020 of the European Data Protection Board on the
concepts of “controller” and “processor” in the
GDPR
“(101) This legal act must be in writing, and an electronic format is
permitted. Therefore, agreements not formalized in writing (regardless
of their comprehensiveness or effectiveness) cannot be considered
sufficient to meet the requirements set forth in Article 28
of the GDPR. In order to avoid any difficulty in proving the validity of the
contract or other legal act, the EDPB recommends ensuring that the
necessary signatures have been included in the legal act in accordance with the provisions of
applicable law (e.g., contract law).”
With regard to the present proceedings, and in accordance with the established facts of
this decision, a personal data breach occurred that affected the
processing carried out by ***ENTERPRISE.1, in its capacity as a processor, on behalf of VODAFONE.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 45/49
With regard to the data processing agreement entered into between VODAFONE and ***ENTERPRISE.1,
although it initially states that (unofficial translation from English) “(…)”, the
fact is that in the section of the agreement containing the signatures of VODAFONE’s two
authorized representatives of VODAFONE, the date shown in their electronic signatures is
“September 4, 2024.” It should be noted that this is in the Anglo-Saxon format (the entire document is
in English) and refers to the date 9/4/2024. Even under the interpretation
most favorable to VODAFONE (9/04/2024), this would be well after the occurrence of
the breach, which took place on 11/20/2023.
We have already seen that the regulations governing the execution of a contract for
the processing of personal data require certain formalities, such as execution
in writing and the signatures of the parties involved. These requirements are not met in this case. This is because
on the date the data breach occurred (November 20, 2023), the contract could not
be considered in force.
Therefore, based on the available evidence, it is considered that
the known facts constitute a violation attributable to VODAFONE,
for breach of the article cited above.
Classification of the violation of Article 28 of the GDPR and determination for purposes of
the statute of limitations
Article 83(4) of the GDPR classifies the violation of the
following articles as an administrative offense; such violations shall be penalized, in accordance with paragraph 2, with administrative fines
of up to 10,000,000 EUR or, in the case of an enterprise,
an amount equivalent to up to 2% of the total annual
for the preceding financial year, whichever is higher:
“a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25
through 39, 42, and 43;
For its part, article 71 of the LOPDGDD, titled “Violations,” states that:
“Acts and conduct referred to in paragraphs 4,
5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are
contrary to this Organic Law, constitute infringements.”
For the sole purpose of the statute of limitations, Article 73 of the LOPDGDD establishes
the following:
“Pursuant to the provisions of Recital 83(4) of Regulation (EU) 2016/679,
infractions that constitute a
substantial violation of the articles mentioned therein, and in particular the
following:
k) Entrusting data processing to a third party without first entering into a
contract or other written legal instrument containing the information required by Article 28.3 of
Regulation (EU) 2016/679.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 46/49
XII
Penalty for non-compliance with Article 28 of the GDPR
In order to determine the administrative fine to be imposed, the
provisions of Articles 83(1) and 83(2) of the GDPR must be observed, as well as Article 76
of the LOPDGDD, as already set forth in the sixth ground of this proposed resolution.
In the present case, considering the seriousness of the potential violation, with
particular regard to the consequences it causes for the data subjects,
the imposition of a fine would be appropriate.
The fine imposed must be, in each individual case, effective, proportionate,
and deterrent, in accordance with the provisions of Article 83(1) of the GDPR. To ensure
these principles are upheld, the turnover of
VODAFONE, which is 2,909,851,000 euros for the year 2024. The maximum amount of the fine
could reach 58,197,020 euros.
For the purposes of deciding on the imposition of an administrative fine and its amount, based
on the available evidence, it is considered appropriate to determine
the penalty to be imposed in accordance with the following circumstances, as set forth in
the aforementioned provisions.
As a preliminary matter, it is determined that the following circumstances exist:
• The nature, gravity, and duration of the violation, taking into account the
nature, scope, or purpose of the processing operation in question, as well
as the number of data subjects affected and the extent of the damages they
have suffered (Article 83(2)(a) of the GDPR).
In this case, the number of data subjects affected must be taken into consideration. It must be
noted that the absence of a data processing agreement prevents effective oversight of the
processor’s compliance with data protection obligations and,
consequently, the protection of the rights and freedoms of the data subjects. (…).
• Intent/Negligence in the infringement (Article 83(2)(b) of the
GDPR): the negligence must be classified as particularly serious. Indeed, there
is no other way to characterize the situation of a telecommunications operator that
enters into contracts with a large number of citizens—and which has been required to enter into and
document its data processing agreements since May 2018—yet
entrusted with services that involve the processing of personal data belonging to
its customers without having entered into the appropriate data processing agreement. This is all the more true given that
enterprises of this type routinely and regularly rely on
outsourcing techniques, as in this case. And the conclusion and validity
of the data processing agreement is essential, as it sets forth the instructions from
the data controller, on the basis of which the processor carries out the processing.
• The categories of personal data affected by the
infringement (Article 83(2)(g) of the GDPR). When assessing the absence of
a data processing agreement, all basic data is involved,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 47/49
subject of the processing, such as the email address associated with the corresponding
first and last names,
Likewise, the following aggravating factor is considered:
• The connection between the offender’s business activity and the processing of
personal data (Article 76.2(b) of the LOPDGDD). On
the one hand, the offender’s main activity involves offering services to the
general public and attracting a large number of customers who are
natural persons. Therefore, the ongoing processing
of their customers’ personal data is an essential part of their activity. On the other hand, the systems targeted by the
attack in this case relate to the marketing of the operator’s
services; thus, they are also specifically linked to the routine
processing of personal data.
In addition, the following mitigating factor is considered
pursuant to Article 83(2) of the GDPR:
- Any measures taken by the controller or processor to
mitigate the damage suffered by the data subjects (Article 83(2)(c)
of the GDPR): it is established in this case that VODAFONE duly formalized
the data processing agreement, albeit after the events occurred.
A balance of the circumstances set forth in Article 83(2) of the GDPR and Article 76(2) of
the LOPDGDD, with respect to the violation committed by breaching the provisions of
Article 28 of the GDPR, allows for the initial imposition of an administrative fine of
ONE HUNDRED THOUSAND EUROS (€100,000).
XIII
In light of the facts set forth, it is considered appropriate to impose a penalty on
the respondent for the violation of Article 28 of the GDPR, Article 32 of the GDPR,
and Article 5(1)(f) of the GDPR, as defined in Article 83(4) of the GDPR and Article 83(5) of the
GDPR.
The penalty to be imposed is an administrative fine in the total amount
of 750,000 euros (SEVEN HUNDRED AND FIFTY THOUSAND EUROS).
for determining the severity of sanctions, the existence of which has been established, the Presidency of
the Spanish Data Protection Agency RESOLVES:
FIRST: TO IMPOSE on VODAFONE ESPAÑA, S.A.U., with Tax ID No. A80907397, for:
- A violation of Article 5(1)(f) of the GDPR, as defined in Article 83(5) of the
GDPR, a fine of 500,000€.
- A violation of Article 32 of the GDPR, as specified in Article 83.4 of the GDPR,
a fine of €150,000.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 48/49
- A violation of Article 28 of the GDPR, as specified in Article 83(4) of the GDPR,
carrying a fine of 100,000 euros.
The total amount of the fine is €750,000 (SEVEN HUNDRED AND FIFTY
THOUSAND EUROS)
SECOND: NOTIFY VODAFONE ESPAÑA, S.A.U. of this decision.
THIRD: This decision shall become enforceable once the deadline for filing the
optional appeal for reconsideration has expired (one month from the day following the
notification of this decision), provided that the data subject has not exercised this
right. The party subject to the penalty is hereby notified that they must pay the imposed penalty
once this decision becomes enforceable, in accordance with the provisions of
Art. 98.1.b) of Law 39/2015, of October 1, on the Common Administrative Procedure
of Public Administrations (hereinafter LPACAP), within the voluntary payment period
established in Art. 68 of the General Collection Regulation, approved
by Royal Decree 939/2005, of July 29, in conjunction with Article 62 of Law 58/2003,
of December 17, by making a deposit, indicating the taxpayer identification number (NIF) of the person subject to the penalty and the
case number appearing at the top of this document, into the
restricted account No. IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code:
CAIXESBBXXX), opened in the name of the Spanish Data Protection Agency at
the bank CAIXABANK, S.A. Otherwise, the amount will be
collected through enforcement proceedings.
Once the notice has been received and becomes enforceable, if the effective date falls
between the 1st and 15th of each month, inclusive, the deadline for making the
voluntary payment will be the 20th of the following month or the next business day thereafter; and if it
falls between the 16th and the last day of each month, inclusive, the payment deadline
shall be until the 5th of the second following month or the next business day thereafter.
In accordance with the provisions of Article 76.4 of the LOPDGDD and given that the
amount of the fine imposed exceeds one million euros, the information identifying the offender, the
violation committed, and the amount of the fine shall be
published in the Official State Gazette.
In accordance with the provisions of Article 50 of the LOPDGDD, this
Resolution shall be made public. Publication shall take place once it has been notified to
the data subjects.
Against this resolution, which concludes the administrative proceedings pursuant to Article 48.6 of the
LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the
data subjects may, at their discretion, file a motion for reconsideration with the
Presidency of the Spanish Data Protection Agency within one month
from the day following notification of this resolution, or directly
file an administrative-litigious appeal with the Administrative-Litigious Chamber of the
National Court, in accordance with the provisions of Article 25 and paragraph 5 of
the fourth additional provision of Law 29/1998, of July 13, governing the
Administrative Jurisdiction, within two months from the
day following notification of this decision, as provided for in Article 46.1 of the
aforementioned Law.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeaepd.gob.es 49/49
Finally, it is noted that, in accordance with the provisions of Article 90.3(a) of the LPACAP,
a final administrative decision may be provisionally suspended if the
data subject expresses their intention to file a contentious-administrative appeal.
If this is the case, the data subject must formally notify the Spanish Data Protection Agency of this fact by
submitting a written notice addressed to the Spanish Data Protection Agency through
the Agency’s Electronic Registry [https://sedeaepd.gob.es/sede-electronica-
web/], or through any of the other registries provided for in Art. 16.4 of the
aforementioned Law 39/2015, of October 1. The data subject must also submit to the Agency the
documentation proving that the contentious-administrative appeal has been
effectively filed. If the Agency is not made aware of the filing of the
contentious-administrative appeal within two months from the day following the
notification of this decision, it will terminate the provisional suspension.
938-101025
Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency
28001 – Madrid 6 sedeaepd.gob.es
