Vodafone fined €45M in Germany for data privacy oversight and security failures

In early June, leading telecommunications company Vodafone was fined a total of €45 million by Germany’s Federal Commissioner for Data Protection and Freedom of Information (BfDI). The fine was split into two major parts. The first, €15 million, was imposed because Vodafone failed to monitor its partner agencies properly. 

‍

According to the regulator, these third-party agencies committed fraud by arranging fake contracts and making unauthorized changes to existing agreements. The BfDI said Vodafone should have had systems in place to verify the actions of these agencies, especially given their role in representing the company to the public.

‍

The second fine, worth €30 million, was tied to Vodafone’s customer authentication processes. The regulator discovered flaws in the company's verification process, which created security risks for customer accounts. This is yet another example of how intertwined security and privacy vulnerabilities are today. 

‍

Both parts of the fine fall under GDPR violations, and the company has announced its commitment to addressing these issues and prioritizing data privacy and security. 

‍