Cybersecurity Policy Report, Vodafone Fined in Germany Over GDPR Violations, (Jun 3, 2025)
Germany’s Federal Commissioner for Data Protection and Freedom of Information (BfDI) has imposed two fines totaling 45 million euros ($51.2 million) on Vodafone GmbH after determining that the telecom carrier’s contract agents violated the European Union’s General Data Protection Regulation (GDPR), BfDI announced today.
The fines include 15 million euros ($17.1 million) over Vodafone’s failure to sufficiently check and monitor partner agencies for GDPR compliance and 30 million euros ($34.1 million) over security vulnerabilities in Vodafone’s German customer portal, MeinVodafone. The vulnerabilities made it possible, among other things, for unauthorized third parties to retrieve eSIM (embedded subscriber identity module) profiles, BfDI said.
BfDI reported that Vodafone, having cooperated with the agency during the proceedings, had since improved its processes and systems. Vodafone has also revised the processes for selecting and auditing partner agencies, parting ways with partners it found to have engaged in fraud. The BfDI will undertake a follow-up inspection to review the practical effectiveness of the measures taken by Vodafone.
News: InternationalLegislation LitigationEnforcement GDPR DataPrivacy DataSecurity