Spain: AEPD fines Vodafone €1,050,000 for unlawful data disclosure an…

Spain's AEPD fined Vodafone €1,050,000 for GDPR violations including unlawful data disclosure to a third party, fraudulent line activation without authorisation, and failure to implement adequate security measures that allowed impersonation and unauthorised access. The fine breaks down as €150,000 for unlawful processing, €150,000 for unlawful disclosure and data modification, and €750,000 for inadequate security. If you run a telecoms or SaaS business handling customer identity, your call centre is now a liability. AEPD's €750,000 penalty for inadequate access controls - not the breach itself, but for not stopping it - means regulators will fine you for each employee who can impersonate a customer.