Administrative fines in the total amount of €45.000.000 imposed on Vodafone by German Supervisory Authority for Data Protection

The German Federal Supervisory Authority for Data Protection imposed a fine of €15 000 000 for insufficient supervision and auditing procedures regarding the partner agencies and imposed a reprimand for the weaknesses in the IT systems. Furthermore, it imposed a fine of €30 000 000 for insufficient security measures regarding the online service portal.

The German Federal Supervisory Authority (SA) launched investigations regarding Vodafone GmbH’s partner agencies and its online service portal after having received external information outside of any complaints.

Vodafone GmbH is a telecommunications service provider operating on the German market. The company uses different distribution channels, including local shops, of which some are operated by partner agencies. They are acting under the Vodafone brand and are bound to the company’s instructions. Their IT systems are based on hard- and software provided by Vodafone. Data Processing Agreements govern the processing of customer data.

Investigations discovered privacy related weaknesses in the processes to supervise and audit the processors as well as weaknesses in the IT systems leading to the risk of customer data being misused for fraud. Such risks actually materialized in some cases.

Furthermore, Vodafone offers an online service portal for its customers. When used in combination with the company’s hotline, investigations by the German Federal SA found weaknesses in the authentication process for the customer accounts that could lead to misuse of eSIMs. The company has taken steps to remediate any shortcomings found. (source: edpb.europa.eu/photo freepik.com)

Comments

Post a Comment

Popular posts from this blog

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Legal Professional Privilege in the Digital Age: Recent case law of the ECtHR and the core principles that should govern searches

Image
By Giorgos Kazoleas, Lawyer The protection of legal professional privilege is a fundamental pillar of the right to respect for private life and correspondence (Article 8 of the ECHR), as well as of the right to a fair trial (Article 6 of the ECHR). In recent years, as the use of digital means in the practice of law has become firmly established, the European Court of Human Rights (ECtHR) has delivered important judgments focusing mainly on the digital age, searches of law offices and the surveillance of communications between lawyer and client. Set out below is a selection of ECtHR case law on such matters: Seizure and retention of vast amounts of lawyers' digital data In Kırdök and Others v. Turkey (3 December 2019), the national authorities seized all the hard drives and digital files of a law office in the course of an investigation, without distinguishing between the documents relating to the case and the confidential files of other clients. The Court found a violat...
Read more

International Criminal Court removes Prosecutor Karim Khan over serious misconduct

Image
International Criminal Court member states voted to dismiss prosecutor Karim Khan following disputed allegations that he sexually assaulted a female member of his staff. The Assembly of States Parties to the Rome Statute of the International Criminal Court held a special session on disciplinary proceedings involving an elected official on 24 July 2026 at United Nations Headquarters in New York. The Assembly adopted a decision, by secret ballot, by an absolute majority of 82 States Parties, finding that Mr. Karim Khan committed serious misconduct and serious breach of duty and removed him from office under article 46 of the Rome Statute. Following the decision, Deputy Prosecutors Nazhat Shameen Khan and Mame Mandiaye Niang, will continue to head the Office of the Prosecutor (the Office). Since Mr Karim A. A. Khan took a leave of absence in May 2025,  the Deputy Prosecutors have assumed responsibility for the leadership, management and administration of...
Read more

Obligation for lawyers to appear in person before disciplinary bodies : Advisory Opinion by ECtHR

Image
The European Court of Human Rights has delivered its opinion in response to a request (no. P16-2026-002) for an advisory opinion made by the Constitutional Court of Grand Duchy of Luxembourg, under Protocol No. 16 to the European Convention on Human Rights. The request concerned the compatibility with Article 6 (right to a fair hearing) of the European Convention of the obligation for a lawyer facing disciplinary proceedings to appear in person at the hearing before the disciplinary body and, in the event of failure to do so, the resulting inability to be represented by counsel instead and to apply to the body in question to set aside an adverse decision entered in default (section 26 of the Law of 10 August 1991). It was made in the context of proceedings in which a former lawyer of the Luxembourg Bar had been disbarred for life by the Luxembourg disciplinary authorities. The Court clarified that the right to a fair hearing did not in principle preclude domestic legislation from...
Read more

Judges’ Freedom of Expression and the Limits of Disciplinary Power: The ECtHR Judgment in Savvas v. Greece

Image
The ECtHR ruled in favor of a Greek judge in a case involving disciplinary proceedings for improper conduct on and off duty ( Savvas v. Greece ). The judge had served extrajudicial notices ( ex-officio legal notices) on three senior colleagues via a court bailiff, requesting that they retract negative comments made against him during a promotion procedure. He was subsequently placed on a three-month suspension. Invoking Article 10 (freedom of expression) of the European Convention on Human Rights, A. Savvas argued that he exercised his legal right to express his opinion in the extrajudicial notices, to defend himself against unfounded accusations, to protect his interests in the context of the promotion process, and to safeguard the public interest by ensuring a fair judicial promotion procedure. The ECtHR found a violation of Article 10 of the ECHR and awarded compensation for pecuniary damage: €5,211.15, non-pecuniary damage: €6,000, and costs and expenses: €1,000. In its judgme...
Read more

Motor vehicle liability insurance: EU law does not preclude the transfer of a claim for compensation held against an insurance company (CJEU)

Image
Motor vehicle liability insurance: EU law does not preclude the transfer of a claim for compensation held against an insurance company (Judgment of the Court of Justice of EU in Case C-277/25- Helpfind Funding and Others). In Poland, several people whose vehicles had been damaged in road traffic accidents received compensation from the insurance undertakings of the persons responsible for those accidents. They took the view that the sums that they had received did not fully remedy their material damage, and therefore assigned their compensation claims to companies specialising in debt recovery, in return for payment. [1] Those professionals then brought legal proceedings against the insurers concerned. The Polish court seised of those disputes referred the matter to the Court of Justice to enquire whether the EU Motor Insurance Directive [2] prevents such an assignment of the right to compensation.  The Court answers that question in the negative. It notes that the directive aims t...
Read more

Questioning Suspects Without a Lawyer: Hungary and Czech Republic Infringed EU Law (CJEU)

Image
Failure of a Member State to fulfil obligations: By allowing, as a general rule, suspects or persons under reasonable suspicion of having committed a criminal offence to be questioned without a lawyer if that lawyer does not attend within a certain period, Hungary and the Czech Republic have infringed EU law (Judgments of the CJEU in Cases C-660/24 | Commission v Hungary and C-681/24 | Commission v Czech Republic). The national legislation of those two Member States cannot be justified by the grounds exhaustively laid down in EU law that permit a temporary derogation from the right of access to a lawyer The directive on the right of access to a lawyer in criminal proceedings [1] provides that suspects and accused persons are to have the right of access to a lawyer in such time and in such a manner so as to allow the persons concerned to exercise their rights of defence practically and effectively. In the sets of proceedings for failure to fulfil obligations brought against Hungary and ...
Read more