The Spanish Data Protection Agency imposed a fine on Vodafone España because the telephone operator was unable to prove that it had received consent from an individual to process that individual’s personal data, and was unable to prove that the individual had ordered service from the company. Further, the company disclosed the personal data to several credit agencies.

https://www.aepd.es/es/documento/ps-00235-2019.pdf