Administrative fines in the total amount of €45.000.000 imposed on Vodafone by German Supervisory Authority for Data Protection

The German Federal Supervisory Authority for Data Protection imposed a fine of €15 000 000 for insufficient supervision and auditing procedures regarding the partner agencies and imposed a reprimand for the weaknesses in the IT systems. Furthermore, it imposed a fine of €30 000 000 for insufficient security measures regarding the online service portal.

The German Federal Supervisory Authority (SA) launched investigations regarding Vodafone GmbH’s partner agencies and its online service portal after having received external information outside of any complaints.

Vodafone GmbH is a telecommunications service provider operating on the German market. The company uses different distribution channels, including local shops, of which some are operated by partner agencies. They are acting under the Vodafone brand and are bound to the company’s instructions. Their IT systems are based on hard- and software provided by Vodafone. Data Processing Agreements govern the processing of customer data.

Investigations discovered privacy related weaknesses in the processes to supervise and audit the processors as well as weaknesses in the IT systems leading to the risk of customer data being misused for fraud. Such risks actually materialized in some cases.

Furthermore, Vodafone offers an online service portal for its customers. When used in combination with the company’s hotline, investigations by the German Federal SA found weaknesses in the authentication process for the customer accounts that could lead to misuse of eSIMs. The company has taken steps to remediate any shortcomings found. (source: edpb.europa.eu/photo freepik.com)

Comments

Post a Comment

Popular posts from this blog

USA announced sanctions against four judges of the International Criminal Court (ICC)

Image
United States announced sanctions against four judges of the International Criminal Court. (ICC). Α s stated in the State Department announcement , the designations are made pursuant to Executive Order (E.O.) 14203,  which authorizes sanctions on foreign persons engaged in certain efforts by the ICC and aims to impose tangible and significant consequences on those directly engaged in the ICC’s transgressions against the United States and Israel.    The International Criminal Court (ICC) responded with a statement that it “deplores the additional designations for sanctions which were announced today (5.6.2025) by the United States of four judges of the Court: Second Vice-President Reine Adelaide Sophie Alapini Gansou (Benin), Judge Solomy Balungi Bossa (Uganda), Judge Luz del Carmen Ibáñez Carranza (Peru) and Judge Beti Hohler (Slovenia). These additional designations follow the earlier designation of Prosecutor Kar...
Read more

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

The Lawyer's right to refuse the defense of an accused person for ethical reasons

Image
by Giorgos Kazoleas, Lawyer LL.M. Lawyers have the right to refuse to undertake a case when it conflicts with their moral principles, their dignity and conscience. Both the Code of Lawyers in Greece and the Code of Lawyers 'Ethics in Cyprus provide the legal framework to support this choice.   The Greek Legislation The lawyer's right to refuse the defense of a specific defendant in a criminal trial clearly follows from the wording of article 37 of the Lawyers' Code (Law 4194/2013). According to paragraph 1 of this article, the lawyer has an obligation to undertake any case, unless it is manifestly unfounded, not amenable to defense, conflicts with the interests of other clients or goes against his/her principles. According to paragraph 2, the lawyer must undertake the defense of any accused, if requested by the judicial authorities, subject to paragraph 1. The reasons for refusing to undertake a case are expanded by article 6 of the Greek Code of Ethics of the Legal Pro...
Read more

Restriction on right to vote in general election did not breach rights of prisoner serving indeterminate sentence for rape (Hora v. United Kingdom)

Image
In Chamber’s judgment in the case of Hora v. the United Kingdom (application no. 1048/20) the European Court of Human Rights held, unanimously, that there had been no violation of Article 3 of Protocol No. 1 (right to free elections) to the European Convention on Human Rights. The case concerned prisoner voting in the United Kingdom. The applicant’s case was the first to come before the Court concerning an election which had taken place following the steps taken by the United Kingdom to enforce the Court’s judgment in the case of Hirst v. the United Kingdom (no. 2) (application no. 74525/01). In the light of the developments since Hirst, the Court examined the manner in which the legislation in question had been applied to the specific applicant, in his particular circumstances. Considering the seriousness of his offending, his conduct, the risk he was found to pose to the public and the resulting imposition of a harsh sentence of indeterminate detention, the Court found that the r...
Read more

Judges’ Freedom of Expression and the Limits of Disciplinary Power: The ECtHR Judgment in Savvas v. Greece

Image
The ECtHR ruled in favor of a Greek judge in a case involving disciplinary proceedings for improper conduct on and off duty ( Savvas v. Greece ). The judge had served extrajudicial notices ( ex-officio legal notices) on three senior colleagues via a court bailiff, requesting that they retract negative comments made against him during a promotion procedure. He was subsequently placed on a three-month suspension. Invoking Article 10 (freedom of expression) of the European Convention on Human Rights, A. Savvas argued that he exercised his legal right to express his opinion in the extrajudicial notices, to defend himself against unfounded accusations, to protect his interests in the context of the promotion process, and to safeguard the public interest by ensuring a fair judicial promotion procedure. The ECtHR found a violation of Article 10 of the ECHR and awarded compensation for pecuniary damage: €5,211.15, non-pecuniary damage: €6,000, and costs and expenses: €1,000. In its judgme...
Read more

The Title Deed Issue in Cyprus and the "Trapped Buyers" Phenomenon

Image
Article By Giorgos Kazoleas, Lawyer LL.M.  The issue of title deeds in Cyprus and the phenomenon of "trapped buyers" constitutes one of the greatest legal, financial, and social peculiarities of Cypriot real estate law. The Cypriot Peculiarity: Sale Without a Title Deed Under Cypriot law (pursuant to the Immovable Property (Tenure, Registration and Valuation) Law, Cap. 224), legal ownership of a property is transferred and acquired solely upon its registration with the Department of Lands and Surveys and the issuance of the relevant Certificate of Registration (Title Deed). However, a major peculiarity exists: it is entirely legal to sell a property that does not (yet) possess a separate title deed. This typically occurs in new developments (apartment buildings or residential complexes), where the title deed for the plot of land belongs to the developer, but the separate title deeds for each apartment or house can take years to be issued due to bureaucracy, pending ap...
Read more

From Regulation to Strategy: Europe’s New Tech Agenda

Image
Written by Efi Thoma, Senior Global Legal Counsel  Europe’s approach to technology regulation is entering a more practical phase. After several years of ambitious rule-making, Brussels is increasingly focused on implementation, enforcement and simplification. For technology companies, the key question is no longer simply “What does the law require?” but “How do we make these requirements work in practice without unnecessarily slowing innovation?” The EU AI Act (Regulation (EU) 2024/1689) establishes a risk-based framework covering areas such as transparency, governance, human oversight and high-risk AI systems. As implementation progresses, the emphasis is increasingly on making the framework workable in practice, including through regulatory sandboxes and measures supporting implementation. For businesses, the practical approach is to embed AI governance into existing processes rather than create an entirely separate compliance structure. AI inventories, risk classification, procu...
Read more