Spanish SA imposes a fine on Telefónica Móviles España, for a loss of confidentiality related to mobile phone sim card duplicate

Mar 31, 2022

Source: European Data Protection Board

Background information

Date of final decision: 08/11/2021
National Case            
Controller: TELEFÓNICA MÓVILES ESPAÑA, S.A.U.          
Legal Reference: Confidentiality (Article 5.1.f)
Decision:  Imposition of a fine of 900,000 euros.
Key words:  Loss of confidentiality.

 

Summary of the Decision

Origin of the case

Various claims are filed as a result of the issuance of duplicate SIM cards to third parties other than subscribers. As a result of the above, the holders of the telephone line are not only left without service, but the third parties access their bank accounts.

We find an assumption of using fraudulent practices based on the generation of duplicates of SIM cards without the consent of their legitimate holders in order to access confidential information for criminal purposes (known as “SIM Swapping”).

Key Findings

Spanish DPA carries out research actions to analyze the procedures followed to manage SIM change requests by TELEFÓNICA MÓVILES ESPAÑA, S.A.U., identifying the vulnerabilities that may exist in the implemented operating procedures, to detect the causes for which these cases could be occurring, as well as to find points of non-compliance, improvement or adjustment, to determine responsibilities, reduce risks and increase security in the processing of personal data of affected persons.

The data that is processed to issue a duplicate SIM card and the SIM card (Subscriber Identity Module), which unequivocally identifies the subscriber on the network, are personal data, and their treatment must be subject to data protection regulations.

It has been verified that the measures implemented by TELEFÓNICA MÓVILES ESPAÑA, S.A.U. were insufficient, so they generated a loss of confidentiality and the transfer of personal data to a third party.

Decision

The AEPD imposes a total fine of 900,000 euros for the infringement consisting of a lack of confidenciality.

 

For further information: https://www.aepd.es/es/documento/ps-00021-2021.pdf

 

The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned

 

Recent news

September plenary – adopted documents

During its September plenary, the EDPB adopted: Opinion 25/2022 regarding the European Privacy Seal (EuroPriSe ) certification criteria for the certification of processing operations by processors 19 September 2022 Publication Type: Opinion of the Board (Art. 64)...

read more

New EDPB opinion on certification criteria

During its latest plenary, the EDPB adopted its opinion on the EuroPrise certification scheme submitted to the Board by the German DPA of North Rhine Westphalia. This is the second EDPB consistency opinion on criteria for a nationwide certification scheme. The...

read more

Record fine for Instagram following EDPB intervention

Brussels, 15 September - Following the EDPB’s binding dispute resolution decision of July 28th, the Irish Data Protection Authority (DPA) has adopted its decision regarding Instagram (Meta Platforms Ireland Limited (Meta IE)) and has issued a record GDPR fine. The...

read more
Generated by Feedzy