Administrative fines imposed by Spanish Data Protection Authority on several mobile phone companies for a loss of confidentiality related to mobile phone SIM cards duplicate

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fines imposed by Spanish Data Protection Authority (SA) on several mobile phone companies for a loss of confidentiality related to mobile phone SIM cards duplicate.

The Spanish SA initiated investigations following various claims as a result of the issuance of duplicate SIM cards to third parties other than subscribers. Consequently, the holders of the telephone line are not only left without service, but the third parties access their bank accounts. As a result of the investigations, the Spanish SA identified vulnerabilities in the implemented operating procedures: duplication of SIM cards without the consent of their legitimate holders; accesses of confidential information for criminal purposes (known as “SIM Swapping”); personal data processed to issue a duplicate SIM card (Subscriber Identity Module), which unequivocally identifies the subscriber on the network processed contrary to data protection regulations; the measures implemented by mobile phone companies were insufficient, so they generated a loss of confidentiality and the transfer of personal data to a third party; the lack of accountability by not having implemented an effective GDPR compliance and management model to avoid the risk of identity theft, in relation to the absence of adequate security measures and aimed at ensuring the procedure of identification and delivery of the SIM card and the delayed temporary reaction to the events described, in addition to the inadequacy of the measures taken.

In this context, Spanish Data Protection Authority applied a fine in the amount of EUR 900 000 to TELEFÓNICA MÓVILES ESPAÑA, a fine in the amount of EUR 70 000 to ORANGE ESPAÑA VIRTUAL, a total fine in the amount of EUR 3 940 000 to VODAFONE ESPAÑA and a fine in the amount of EUR 200 000 to XFERA MÓVILES, S.A for a loss of confidentiality related to mobile phone SIM cards duplicate.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.