Major European comms provider slapped with €45M over privacy and security breaches

The Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) has issued two fines to Vodafone due to privacy and security breaches.

The telecom operator received a €15 million fine because it failed to adequately check and monitor its partner agencies. The case involves companies that drafted contracts on behalf of Vodafone for customers. Employees used fake contracts or modified them to harm customers, resulting in customers paying too much for their subscriptions.

In addition, Vodafone received a €30 million slap on the wrist for security vulnerabilities in the authentication process when using the MyVodafone online portal while simultaneously calling the Vodafone hotline. Employees didn’t sufficiently check whether a customer actually was who he said he was. Unauthorized persons were thus able to gain access to customers’ eSIM profiles.

The telecom provider has improved its processes and systems to prevent recurrence. The operator has also announced that it will end all collaboration with fraudulent partner companies. The BfDI will conduct an additional investigation to verify that the measures have worked. The total amount of €45 million has been paid.

Vodafone says it’s committed to strong data protection and fundamental rights and considers them as the basis for customer trust. Therefore, as a commitment to the importance of data protection, the company has donated €7 million to various organizations that are committed to promoting data protection, media literacy, and digital literacy, as well as combating cyberbullying.

“Where data protection violations take place, sanctions must be given. With my work, however, I would also like to ensure that data protection violations do not occur in the first place. Companies that want to comply with data protection law must be empowered to do so. Data protection is a factor of trust for users of digital offers and can therefore become a competitive advantage. More and more companies understand that,” Prof. Dr. Louisa Woodpecker of the BfDI said in a statement.