Vodafone Group Plc
Domicile: United Kingdom
Website: www.vodafone.com
Operating company evaluated: Vodafone UK
Download company report: English
Key findings
- Vodafone continued to be among the most transparent telecommunications companies in the RDR Index about its policies and practices that affect users' human rights.
- It was the only company to disclose comprehensive information about policies for handling data breaches.
- While it improved disclosure of what data it collects and for how long it is stored, Vodafone should be more transparent about how it handles and secures user information.
- Vodafone UK (Prepaid mobile)
- Vodafone UK (Postpaid mobile)
- Vodafone UK (Fixed-line broadband)
Analysis
Vodafone's score in the 2019 RDR Index remained steady at 52%, but the company’s ranking dropped to second place among telecommunications companies.1 Despite improved privacy policy disclosure, it was outpaced in this area by some of its peers, including Telefónica—the only telecommunications company to outperform Vodafone in this year’s RDR Index.2 A member of the Global Network Initiative (GNI), Vodafone disclosed strong governance and oversight over human rights issues across its global operations, and excelled in key areas relative to its peers. It was the only company in the RDR Index to disclose comprehensive information about how it handles data breaches. It was one of only two telecommunications companies to commit to uphold net neutrality principles. The company made strides by spelling out the types of user information it collects and for how long it retains data on former users, but still did not disclose enough about how it handles user data. The company could also do more to explain how it handles and responds to government requests and other types of third party requests to block content and deactivate user accounts or to hand over user information.
Vodafone Group Plc provides telecommunications services in Europe, Asia, the Middle East, and Africa. The company serves 535.8 million mobile, 19.7 million fixed broadband, and 13.7 million TV customers.3
Market cap: USD 50.7 billion4
LSE: VOD
- Improve human rights due diligence: Vodafone should demonstrate it carries out human rights risk assessments on existing products and services, as well as on its terms of service enforcement, its use of automated decision-making, and its targeted advertising policies and practices.
- Clarify handling of user data: Vodafone should be more transparent about its reasons for collecting and sharing user information, and clarify options users have to control what data is collected and shared about them.
- Be transparent about third-party requests affecting freedom of expression: Vodafone should better inform users about third-party requests (including from governments) to block content and to shut down networks, and disclose where laws may prevent it from being fully transparent about these types of requests.
Governance
Vodafone’s strongest performance in this year’s RDR Index was in the Governance category, where it received the third-best score among telecommunications companies. It disclosed a clear commitment to respect freedom of expression and privacy as human rights (G1) but fell behind many of its GNI peers for weak disclosure of human rights due diligence practices (G4). Vodafone disclosed that it conducts human rights impact assessments when entering new markets, but not whether it does so on existing products and services, the impacts of its terms of service enforcement, its use of automated decision making, or its targeted advertising policies or practices (G4). Vodafone earned the second highest score after Telefónica for disclosure of its grievance and remedy mechanisms (G6) although gaps remained. While Vodafone provided users with several options to submit complaints, including those related to freedom of expression and privacy, it offered no information about the number of complaints it received or any evidence that it provides users with remedy.
No score changes
Freedom of Expression
Vodafone received the second-highest score in the Freedom of Expression category among telecommunications companies, behind Telefónica—but its disclosure of policies affecting users’ freedom of expression was inadequate in key areas. While Vodafone UK’s terms of service for mobile and broadband were easy to understand (F1) it was not clear whether users are notified of changes (F2).5 Vodafone disclosed less than AT&T and Telefónica about how it handles government and private requests to block content or restrict accounts, but it was one of the few telecommunications companies to disclose any information about its handling of these types of requests (F5-F7). While the company had strong disclosure of its process for handling government requests, it was less clear about how it handles similar private requests (F5). It also disclosed no data about the number of requests it received or with which it complied (F6, F7).
Vodafone UK tied with Telefónica Spain for the highest score on disclosure of network management policies, and disclosed a clear commitment to net neutrality (F9). It disclosed more than most of its peers, aside from Telefónica and Telenor, about its process for responding to network shutdown demands, although it did not disclose how many shutdown requests it received or with which it complied (F10).
F2. Changes to terms of service
Vodafone UK no longer disclosed a time frame for notifying users of changes to its postpaid mobile terms.
F3. Process for terms of service enforcement
Vodafone UK was less transparent regarding the types of content and activities it does not allow.
Privacy
Vodafone did not disclose enough about its policies affecting privacy—falling behind Deutsche Telekom, AT&T, and Telefónica—although it earned high marks on its security disclosures. Revisions to Vodafone UK’s privacy policy to comply with the EU’s General Data Protection Regulation (GDPR) did improve clarity about handling of user data (P3-P8) in a number of areas: it improved its disclosure of the types of information it collects (P3) and for how long it retains some user data after account termination (P6). But it still disclosed less overall than many of its peers—Deutsche Telekom, Telefónica Spain, Telenor Norway, and AT&T—about how it handles user information: it did not disclose whether users can control collection of their own information or whether users can delete some of this information (P7). While it explained how people can opt out of having their data used for advertising, it failed to disclose if targeted advertising is turned off by default (P7).
Vodafone disclosed less than AT&T and Telefónica about how it handles government and private demands for user information (P10, P11). It explained its process for responding to government requests for user data, but not how it responds to other types of third-party requests (P10). It failed to disclose if it notifies users when government entities or other third parties request their information (P12).
It disclosed more about its security policies (P13-P18) than any other telecommunications company aside from Deutsche Telekom—although it lost points in this year’s RDR Index for being less transparent than previously about its internal policies for keeping user data secure (P13). Notably, it was the only company in the RDR Index to offer comprehensive information on its handling of data breaches (P15).
P2. Changes to privacy policies
Vodafone UK disclosed an improved commitment to notify users of changes to its privacy policies.
P3. Collection of user information
Vodafone UK improved its disclosure of the types of user information it collects.
P6. Retention of user information
Vodafone UK disclosed time frames for deleting some types of information after users terminate their accounts.
P13. Security oversight
Vodafone UK was less transparent about whether it limits and monitors employee access to user information.
Footnotes
[1] The research period for the 2019 Index ran from January 13, 2018 to February 8, 2019. Policies that came into effect after February 8, 2019 were not evaluated in this Index.
[2] For Vodafone’s performance in the 2018 Index, see: rankingdigitalrights.org/index2018/companies/vodafone
[3] 2018 Vodafone Group Plc Annual Report, www.vodafone.com/content/annualreport/annual_report18/downloads/Vodafone-full-annual-report-2018.pdf
[4] Bloomberg Markets, Accessed April 18, 2019, www.bloomberg.com/quote/VOD:LN
[5] For most indicators in the Freedom of Expression and Privacy categories, RDR evaluates the operating company of the home market, in this case Vodafone UK.
