Vodafone fine: 45 million euros (BfDI)

Fine against Vodafone: 45 million

Staff at partner agencies fabricate contracts, unauthorised persons retrieve other people's eSIM profiles, and in the end the principal pays. In 2025, the Federal Commissioner for Data Protection and Freedom of Information (BfDI), Louisa Specht-Riemenschneider, imposed two fines on Vodafone GmbH. Together they amount to 45 million euros (press release 6/2025). 15 million euros relate to inadequate oversight of partner agencies, 30 million euros to security failings in authentication on the customer portal and the hotline. There was also a reprimand for weaknesses in certain sales systems. Vodafone has accepted both fines and paid them in full to the federal treasury.

The federal authority has jurisdiction because it supervises data protection at telecommunications companies. For companies in other sectors, the state authorities are usually responsible. Even so, the case concerns every company that passes customer data to sales partners or operates a customer portal. Both allegations concern everyday matters: the oversight of service providers and the question of whether the person at the portal or on the hotline really is the customer.

Partner agencies: 15 million euros

Vodafone has contracts arranged through partner agencies. These agencies act on behalf of the group and process customer data in doing so. That makes them processors, that is, service providers that process personal data on the instructions of another company. According to the authority's findings, fraud occurred at partner agencies: staff acting in bad faith fabricated contracts or altered existing contracts to the detriment of customers.

The fine of 15 million euros is directed at Vodafone itself. The allegation is that Vodafone did not check and monitor its own partner agencies sufficiently in data protection terms. The General Data Protection Regulation (GDPR) only permits processors that offer sufficient guarantees for data protection. It is for the principal to check whether those guarantees exist and are being met. What was sanctioned, then, was not the fraud itself but the lack of control over the service providers.

eSIM profiles: 30 million euros

The second fine is twice as high and concerns the technology. Vodafone customers manage their contracts in the "MeinVodafone" online portal and call the hotline when needed. Where both routes were used in combination, authentication showed security failings, that is, the check on whether the customer is the one making the request. Among other things, the weaknesses allowed eSIM profiles to be retrieved by unauthorised third parties. An eSIM profile is the digital version of a SIM card, which can be loaded onto a device without a plastic card. Anyone who retrieves someone else's profile can use that customer's number on their own device.

The press release does not describe how the gap worked in detail. It names only the outcome: security failings in authentication, 30 million euros. Because of further weaknesses in certain sales systems, the authority additionally issued a reprimand. A reprimand is the milder supervisory measure; it costs nothing and still formally establishes the infringement.

Cooperation and follow-up review

The authority emphasises how Vodafone conducted itself during the proceedings. "Vodafone cooperated continuously throughout the entire proceedings and disclosed circumstances that incriminated the company itself," says Specht-Riemenschneider. The company has improved its processes and systems and in some cases replaced them entirely. It has put the selection and auditing of partner agencies on a new footing and parted company with partners where fraud was established. Projects for IT consolidation and modernisation were brought forward, and the compliance and data protection functions were strengthened. Vodafone also donated several million euros to organisations working for data protection and media literacy.

That does not close the matter. The BfDI has announced that it will review the practical effectiveness of the measures in a follow-up check. Under the GDPR, cooperation with the supervisory authority is one of the criteria for the level of a fine. The press release does not reveal whether, or how strongly, it had an effect here. At 45 million euros, a discount is not exactly conspicuous.

Lessons for companies working with partners

Anyone who lets sales partners, call centres or agencies work with customer data remains responsible for that data. A data processing agreement is the basis for this, but no more than that. The authority criticises Vodafone for both checking and monitoring, that is, both phases: selection before appointment and oversight during the cooperation. The press release also identifies this as a general problem: in the experience of the data protection authorities, the use of processors is often not sufficiently monitored in practice.

What Vodafone has since put in place serves as a template. First, a selection procedure that vets partners on data protection before cooperation begins. Second, audits during the term that go beyond requesting documents. Third, consequences: where fraud is established, the cooperation ends. Anyone unable to evidence these steps when an incident occurs will find it hard to point to the bad faith of individual staff at the partner. In Vodafone's case, that circumstance did not save the company from a 15 million euro fine.

Review portal and hotline together

The second lesson concerns every company with a customer portal. The authority locates Vodafone's failings in the combined use of the online portal and the hotline. A security review that looks at each channel in isolation misses such combinations. It therefore makes sense to look at identity verification across all routes. What does a caller on the hotline have to know, what does the portal display, what can be done in one using the other? Functions that go beyond viewing the contract are particularly sensitive. Retrieving an eSIM profile is one such function, because with the profile the phone number moves to someone else's device. What can be done with it, from SMS codes to calls made in the customer's name, hardly needs spelling out here.

The authority places the case in a wider frame. In the experience of the data protection authorities, many sectors face a backlog of investment in modernising and consolidating IT systems, and savings are sometimes made on security. Specht-Riemenschneider's formula for this is: "invest rather than risk". Old systems that nobody wants to touch any more are, in the supervisory authority's view, the company's own risk, and the company answers for it.

Conclusion

The 45 million euros against Vodafone stand for two duties that easily get short shrift in day-to-day business. Service providers handling customer data must be vetted before appointment and monitored thereafter. Identity verification in customer contact must hold up across all channels. Fraud by individual staff at a partner does not relieve the principal where oversight was lacking.

The authority expressly acknowledged the cooperation and the swift remedial action. They are no substitute for investment that should have been made earlier.