[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fK1dwQoTktgp_fWm5pWRhN_eibI7CvpWommrmqtzGIeI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49},"40be4b86-f211-4834-918e-aa1896a9ce51","vodafone-espaa-fined-105m-for-unauthorized-line-registration-and-data-disclosure","6faf52f1-bdc2-4a74-ac3a-6f6bb73894d5","Vodafone España Fined €1.05M for Unauthorized Line Registration and Data Disclosure","Vodafone España failed to verify a valid legal basis before registering an additional mobile line under a customer's name, violating GDPR's lawfulness of processing principle. Compounding this, a duplicate invoice containing personal data was sent to an unauthorized third-party email address, exposing sensitive customer information without consent. These failures indicate systemic weaknesses in identity verification, authorization controls, and data handling procedures. The €1,050,000 fine underscores that telecoms and other data controllers must enforce strict data minimization and access validation at every customer interaction point. Inadequate technical and organizational safeguards not only harm affected individuals but expose organizations to severe regulatory and reputational consequences.","**Immediate actions:**\n- Audit all customer account modification workflows to ensure a documented and verified legal basis (e.g., consent or contract) is captured before any changes are made.\n- Implement strict email address validation controls so that documents containing personal data can only be sent to verified, customer-confirmed contact addresses.\n\n**Long-term improvements:**\n- Deploy a Data Protection Impact Assessment (DPIA) process for all high-risk data processing activities, including account provisioning and invoice delivery.\n- Establish role-based access controls (RBAC) and mandatory dual-authorization for actions that create or modify customer accounts.\n- Embed GDPR compliance checks into CRM and billing system workflows to enforce lawful basis verification as a non-bypassable step.\n\n**Detection & monitoring measures:**\n- Implement automated logging and alerting for anomalous account activities, such as duplicate line registrations or document dispatch to unregistered addresses.\n- Conduct regular internal audits and staff training focused on data handling procedures, particularly around customer communications and third-party disclosures.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 6 – Lawfulness of processing","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-3 (Access Enforcement)","NIST SP 800-53 SI-12 (Information Management and Retention)","CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","ITIL Service Operation – Access Management","published","2026-06-18T10:20:47.92605+00:00","2026-06-18T10:20:47.793+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00201-2025&diff=51912&oldid=0","aepd-spain-ps-00201-2025-56177a","AEPD (Spain) - PS-00201-2025",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]