BULLETIN №081Last updated · 26 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 01 Jan 2019 | VODAFONE ESPAÑA, S.A.U.Vodafone España was fined 40,000 EUR by the AEPD for charging a customer for a Netflix service that had not been contracted. The authority found a breach of GDPR Article 6 due to the lack of a lawful basis for the charge and related processing. | ES | AEPD | GDPR | €40,000 | ↗ |
| 23 Aug 2021 | VODAFONE ESPAÑA, S.A.U.Vodafone España was fined by the AEPD for breaching data protection principles. The case involved issuing SIM card duplicates to unauthorized individuals, which compromised data integrity and confidentiality. | ES | AEPD | GDPR | €4,000,000 | ↗ |
| 01 Mar 2022 | VODAFONE ESPAÑA, S.A.U.Vodafone España was fined by the AEPD for failing to adequately prevent unauthorized SIM card duplication. The incident enabled fraudulent access and transactions on a customer's accounts. | ES | AEPD | GDPR | €140,000 | ↗ |
| 01 Jan 2021 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 50,000 EUR for breaching data protection rules. The case concerned deficiencies in the security and integrity of data processing. | ES | AEPD | GDPR | €50,000 | ↗ |
| 23 Apr 2021 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 50,000 EUR for changing a customer's mobile line ownership without consent. The company also charged the customer's account amounts related to a third party's phone line. | ES | AEPD | GDPR | €50,000 | ↗ |
| 12 Nov 2020 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD EUR 70,000 for continuing to send billing emails to a complainant despite an arbitration ruling. The ruling required the company to stop all services and delete the complainant’s data, which it failed to do. | ES | AEPD | GDPR | €70,000 | ↗ |
| 12 Mar 2019 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 45,000 EUR by the AEPD for sending continuous SMS messages to a complainant despite a prior request to cancel personal data. The authority found this conduct to be a breach of data protection principles. | ES | AEPD | GDPR | €45,000 | ↗ |
| 17 May 2021 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 5,000 EUR by the AEPD for failing to provide requested information. The case concerns a breach of obligations under data protection rules. | ES | AEPD | GDPR | €5,000 | ↗ |
| 30 Mar 2021 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 150,000 EUR for failing to delete personal data after phone contracts ended. This led to continued SMS notifications with zero-balance invoices being sent to former customers. | ES | AEPD | GDPR | €150,000 | ↗ |
| 06 Feb 2023 | VODAFONE ESPAÑA, S.A.U.The AEPD imposed a 200,000 EUR fine on VODAFONE ESPAÑA, S.A.U. for breaching Article 6(1) GDPR. The case involved unauthorized SIM card duplication that enabled fraudulent bank charges. | ES | AEPD | GDPR | €200,000 | ↗ |
| 04 Dec 2019 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 5,000 EUR by the AEPD for failing to provide requested information. The case concerned a breach of obligations under data protection rules. | ES | AEPD | GDPR | €5,000 | ↗ |
| 30 Jun 2020 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 15,000 EUR for incorrectly listing a customer's ex-spouse as the account holder, even though the customer's data appeared on invoices. The company acknowledged responsibility and paid the reduced fine. | ES | AEPD | GDPR | €15,000 | ↗ |
| 01 Jan 2024 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 200,000 EUR by the AEPD for issuing a duplicate SIM card without the customer’s consent. The incident led to unauthorized financial transactions, indicating significant failures in authorization and security controls. | ES | AEPD | GDPR | €200,000 | ↗ |
| 12 Jun 2017 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 3,300 EUR for sending commercial communications to a former customer after a request for data cancellation. The authority also noted an allegation of sharing personal data with third parties without consent. | ES | AEPD | ePrivacy | €3,300 | ↗ |
| 27 Oct 2020 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 50,000 EUR by the AEPD for requesting payment for services contracted without the complainant’s consent. The case concerns a data protection breach linked to processing and debt collection without a valid legal basis. | ES | AEPD | GDPR | €50,000 | ↗ |
| 10 Jun 2019 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 10,000 EUR for sending unsolicited advertising SMS messages to a complainant. The messages were sent despite the recipient’s request not to receive such communications. | ES | AEPD | ePrivacy | €10,000 | ↗ |
| 08 Apr 2024 | VODAFONE ESPAÑA, S.A.U.The AEPD imposed a fine of 250,000 EUR on VODAFONE ESPAÑA, S.A.U. for failing to implement adequate measures to prevent unauthorized access to personal data. The authority found a breach of the GDPR confidentiality requirements. | ES | AEPD | GDPR | €250,000 | ↗ |
| 24 Jun 2020 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 75,000 EUR for continuing to send promotional SMS messages to an individual whose personal data had previously been deleted. The authority found this conduct to be in breach of Article 6 GDPR. | ES | AEPD | GDPR | €75,000 | ↗ |
| 11 May 2022 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined EUR 70,000 by the AEPD for issuing a duplicate SIM card without the customer's consent. This enabled unauthorized access to the customer's bank account, indicating a serious failure in security and data protection controls. | ES | AEPD | GDPR | €70,000 | ↗ |
| 06 Feb 2020 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 70,000 EUR by the AEPD for a personal data breach. An error in assigning identification numbers allowed one customer to access another customer's personal data. | ES | AEPD | GDPR | €70,000 | ↗ |