Vodafone Italia S.p.A.
- Country
- Italy
- Fine
- 12,251,601 EUR
- Date
- 2020-11-12
- Sector
- Telecommunications
- Articles
- Art. 5art. 6art. 7art. 15art. 16art. 21art. 24art. 25art. 32 andart. 33 of GDPR
No measures ensuring the control of the legitimacy of the data collected, consent for the sharing of data, marketing actvies in contrast with the right to objects, inadequate security measures and mismanagement of data breaches
The Italian DPA found out the violation by Vodafone Italia S.p.A. of the key principles of GDPR such as accountability and data protection by design in addition of the violation of content requirements. More specifically, the Italian DPA discovered the use for marketing purposes of fake telephone numbers or numbers that were not registered with Italian registry under Vodafone’s own spotlight. Additional violations are related to the handling of contact lists purchased from external providers as those lists were obtained by Vodafone partners from other companies without the required users’ free, informed, and specific consent.