Administrative fines in the total amount of €45.000.000 imposed on Vodafone by German Supervisory Authority for Data Protection

The German Federal Supervisory Authority for Data Protection imposed a fine of €15 000 000 for insufficient supervision and auditing procedures regarding the partner agencies and imposed a reprimand for the weaknesses in the IT systems. Furthermore, it imposed a fine of €30 000 000 for insufficient security measures regarding the online service portal.

The German Federal Supervisory Authority (SA) launched investigations regarding Vodafone GmbH’s partner agencies and its online service portal after having received external information outside of any complaints.

Vodafone GmbH is a telecommunications service provider operating on the German market. The company uses different distribution channels, including local shops, of which some are operated by partner agencies. They are acting under the Vodafone brand and are bound to the company’s instructions. Their IT systems are based on hard- and software provided by Vodafone. Data Processing Agreements govern the processing of customer data.

Investigations discovered privacy related weaknesses in the processes to supervise and audit the processors as well as weaknesses in the IT systems leading to the risk of customer data being misused for fraud. Such risks actually materialized in some cases.

Furthermore, Vodafone offers an online service portal for its customers. When used in combination with the company’s hotline, investigations by the German Federal SA found weaknesses in the authentication process for the customer accounts that could lead to misuse of eSIMs. The company has taken steps to remediate any shortcomings found. (source: edpb.europa.eu/photo freepik.com)

Comments

Post a Comment

Popular posts from this blog

Fully-funded PhD position in AI, Law and Public Power

Image
Erasmus University Rotterdam School of Law, department Law & Markets, is looking for a fulltime PhD researcher in AI, Law and Public Power (4,5 years with 20% teaching tasks). PhD AI, Law and Public Power Are you curious about how artificial intelligence is changing state actor powers? Do you want to conduct critical and in-depth legal research at the intersection of technology, law and power? And would you like to combine that with academic teaching? Then this PhD position at Erasmus School of Law is for you. Within the Law & Markets team, you will spend 4.5 years researching the legal regulation of AI in the public sector. How do we protect fundamental rights when algorithms help decide on who receives public benefits, how to perform enforcement or how to enact environmental policy? What is the role of the state, and where is the limit of government power in a data-driven society? You will have plenty of space to choose your own research angle and work in a multidisci...
Read more

Cancellation of a flight: The refund of the airline ticket price must include the commission collected by an intermediary at the time of purchase (CJEU)

Image
Judgment of the Court in Case C-45/24 (15.1.2026)- Verein für Konsumenteninformation : Cancellation of a flight: the refund of the airline ticket price must include the commission collected by an intermediary at the time of purchase. It is not necessary for the airline to know the exact amount of that commission. Several travellers purchased airline tickets on the booking portal of the Opodo travel agency [1] for a KLM return flight from Vienna (Austria) to Lima (Peru). Since the flights were cancelled, KLM reimbursed the amount they had paid, minus approximately € 95 that Opodo had charged them as agency commission. The air passengers concerned assigned their potential rights to reimbursement to a consumer protection association. That association contends, before the Austrian courts, that the reimbursement of the cost of the airline tickets by the airline in question should include the agency commission charged to passengers, as in the present case, by a travel agency acting as that a...
Read more

The Concept of "Habitual Residence" as a Jurisdictional Basis in International Parental Responsibility Disputes: The Cypriot Approach

Image
Written By Giorgos Kazoleas, Lawyer at Legal Experts Cyprus In modern private international law, determining the Forum Conveniens (the appropriate court) for resolving parental responsibility disputes is a critical issue for ensuring the best interests of the child. Within the Cypriot legal order, the jurisdiction of Family Courts in cases involving international elements—such as those involving third-country nationals—is primarily established through the concept of "habitual residence." 1. The Legal Framework: The 1996 Hague Convention and National Law The establishment of jurisdiction for Cypriot Courts arises from the combined application of international and national rules: 1996 Hague Convention [1] : According to Article 5, the judicial or administrative authorities of the Contracting State of the child’s habitual residence have jurisdiction to take measures directed at the protection of the child’s person or property. The Family Courts Law (Law 23/1990) : Arti...
Read more

Pretextual Threats of Collective Redundancies: A Form of Workplace Harassment (Mobbing) under Cyprus Law

Image
Written by Giorgos Kazoleas, Managing Partner Lawyer at Legal Experts Cyprus In the Cypriot labor market, personnel management is often characterized by employer practices that exploit the fear and insecurity of employees. A particularly serious issue is the pretextual threat of collective redundancies within companies and enterprises. When such a threat does not reflect a genuine need for restructuring or financial distress, but is instead used deceptively as leverage to intensify labor and suppress claims (e.g., salary increases, bonus claims, other benefits, promotions, etc.), it transforms into a form of workplace harassment (mobbing) with specific legal implications. The Specialized Legal Framework: Law 42(I)/2025 The legal handling of this phenomenon—which has reached concerning proportions in Cyprus—was decisively strengthened by the enactment of the Prevention and Combating of Violence and Harassment at the Workplace Law of 2025 (Law 42(I)/2025). This law incorporates the...
Read more

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Annual Report on the execution of the European Court's judgments and decisions

Image
The Secretary General of the Council of Europe, Alain Berset, has called for further efforts to implement judgments from the European Court of Human Rights. Commenting on the  annual report for 2024  on the execution of the Court’s rulings, published today, the Secretary General said: “ This report shows what a concrete, positive impact judgments from the European Court of Human Rights have on the daily lives of the people of Europe. While a lot has been achieved, more needs to be done. The efficient execution of the Court's judgments is essential for the rule of law and democratic accountability in Europe .” The annual report from the Council of Europe’s Committee of Ministers shows that 992 cases were transferred from the European Court of Human Rights to Committee, which supervises their implementation by member states, in 2024. Of those 992 new cases, 194 were “leading” cases – often requiring action to be taken by states to prevent the same violations happ...
Read more

Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject (CJEU)

Image
Judgment of the Court of Justice in Case C-422/24 (Storstockholms Lokaltrafik) dated 18.12.2025 - GDPR: If a body camera is used during a ticket inspection, certain information must be provided immediately to the passenger concerned. The most important information may be indicated on a warning sign, while other information may be provided in an easily accessible place. A public transport company in Stockholm (Sweden) equips its ticket inspectors with body cameras to film passengers during ticket inspections. The Swedish Authority for Privacy Protection fined that company for breaching several provisions of the General Data Protection Regulation (GDPR). [1]  Among other things, it considers that the use of body cameras allowed personal data to be collected directly [2] from the persons filmed, who had not been provided with sufficient information in that regard.  The company disputes that there has been a breach of the obligation to provide information. It maintains that it col...
Read more