Vodafone Italy S.p.A

What happened

The Italian DPA (Garante) imposed a fine of €12.25 million on Vodafone Italia S.p.A, following an inquiry into their telemarketing practices which revealed that Vodafone was in violation of several GDPR articles. Vodafone was ordered to implement more appropriate measures to prevent the unauthorized access of customer databases and to ban the further processing of personal data. The Garante initiated the inquiry after multiple complaints from people who received constant unwanted phone-calls from Vodafone telemarketers. Among other things, the inquiry found that Vodafone was using contacts lists purchased from external providers without user consent for telemarketing, and that the security measures implemented by Vodafone to protect their client’s data were inappropriate, as unauthorized parties were calling customers and requesting IDs by pretending to be Vodafone.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal dataRead →
• Art. 6Lawfulness of processingRead →
• Art. 7Conditions for consentRead →
• Art. 15Right of access by the data subject15(1)Read →
• Art. 16Right to rectificationRead →
• Art. 21Right to objectRead →
• Art. 24Responsibility of the controllerRead →
• Art. 25Data protection by design and by default25(1)Read →
• Art. 32Security of processingRead →
• Art. 33Notification of a personal data breach to the supervisory authority33(1)Read →

• Accountability
• Consent
• Data breach
• Data principles
• Data security
• Data subject rights
• Unlawful processing