BfDI (Germany) - Vodafone

BfDI - Vodafone
Authority:	BfDI (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 28(1) GDPR Article 32(1) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	10.03.2025
Published:
Fine:	45,000,000 EUR
Parties:	n/a
National Case Number/Name:	Vodafone
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	German
Original Source:	BfDI (in DE)
Initial Contributor:	Le

A DPA imposed two fines totalling €45,000,000 on Vodafone for security deficiencies and failure to adequately review and monitor partner agencies working on its behalf.

English Summary

Facts

Vodafone GmbH is a telecommunications service provider acting as controller of personal data.

The DPA (Federal Commissioner for Data Protection and Freedom of Information-BfDI) launched investigations regarding Vodafone's partner agencies and its online service portal after having received external information.

Vodafone uses different distribution channels, including local shops, of which some are operated by partner agencies. Their IT systems are based on hardware and software provided by Vodafone. As processors, they are acting under the Vodafone brand and are bound to the Vodafone’s instructions. Investigations discovered privacy related weaknesses in the processes to supervise and audit the processors, as well as weaknesses in the IT systems leading to the risk of customer data being misused for fraud.

Furthermore, Vodafone offers an online service portal for its customers that presents security defects in the authentication process leading to misuse of eSIMs by unauthorized third parties.

Holding

The DPA imposed a fine of €15,000,000 on Vodafone for insufficient supervision and auditing procedures regarding its processors, in violation of Article 28(1) GDPR, and imposed a reprimand for the weaknesses in the IT systems (Article 32(1) GDPR). Furthermore, the DPA imposed a fine of €30,000,000 for insufficient security measures regarding the online service portal in violation of Article 32(1) GDPR.

Comment

This summary is based on a press release issued by the DPA on 3 June 2025, as the official decision has not been published yet.

According to the press release, Vodafone GmbH has now improved its processes and systems and in some cases even completely replaced them in order to eliminate such risks in the future. It has also revised the processes for selecting and auditing partner agencies and it has separated from partners identified as having committed fraud. In a follow-up check, the DPA will review the practical effectiveness of the measures taken by Vodafone.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

BfDI Imposes Fines on Vodafone

The BfDI, headed by Prof. Dr. Louisa Specht-Riemenschneider, has imposed two fines totaling €45 million on Vodafone GmbH. Malicious employees in partner agencies that broker contracts to customers on behalf of Vodafone have led to cases of fraud, including fictitious contracts or contract changes to the detriment of customers.
A smartphone is used for authentication when using a laptop.
Source: ©THAWEERAT-stock.adobe.com

A fine of €15 million was imposed because Vodafone GmbH failed to adequately review and monitor partner agencies working for it in accordance with data protection law (Article 28 (1) Sentence 1 GDPR).

In addition, the BfDI issued a warning to Vodafone for a violation of Article 32 (1) GDPR due to vulnerabilities identified in certain sales systems.

A further fine of €30 million was imposed for security deficiencies in the authentication process when using the "MeinVodafone" online portal combined with the Vodafone hotline. The discovered authentication vulnerabilities enabled, among other things, unauthorized third parties to access eSIM profiles.

Vodafone GmbH has since improved its processes and systems and, in some cases, even completely replaced them to prevent such risks in the future. It has also revised its processes for selecting and auditing partner agencies and has separated from partners identified as having engaged in fraud. The Federal Institute for Information Security (BfDI) will review the practical effectiveness of the measures taken by Vodafone in a follow-up audit.

"I would like to emphasize that Vodafone has cooperated with me continuously and without restriction throughout the entire proceedings and has also disclosed circumstances that have incriminated the company," emphasizes Specht-Riemenschneider. The fines have been accepted and have already been paid in full to the Federal Treasury.

The experience of data protection authorities shows that companies in many industries are experiencing an investment backlog in the modernization and consolidation of IT systems. As a result, some cutbacks are made in security. The use of data processors is also often not adequately monitored in practice. New technological possibilities and more complex threat scenarios lead to increased risks for customers, who can suffer damage due to a lack of data protection.

Data protection is often mistakenly viewed as an obstacle to IT investments. The opposite is true: Without IT investments, security incidents and even sanctions from data protection regulators are imminent. Hence my appeal: Invest instead of risk!
Prof. Dr. Louisa Specht-Riemenschneider

In the case of Vodafone GmbH, the company has changed course and prioritized IT consolidation and modernization projects, and strengthened the areas of compliance and data protection. Vodafone has thus committed itself to strong data protection and fundamental digital rights and sees them as the basis for customer trust. As a commitment to the importance of data protection, Vodafone GmbH has also donated a total of several million euros to various organizations dedicated to promoting data protection, media competence and digital literacy, and combating cyberbullying.

Specht-Riemenschneider concluded: "Where data protection violations occur, sanctions must be imposed. However, I also want my work to prevent data protection violations from occurring in the first place. Companies that want to comply with data protection law must be empowered to do so. Data protection is a factor of trust for users of digital services and can therefore become a competitive advantage. More and more companies are understanding this."