Spanish DPA Imposes Fines on Orange Espagne, Orange España Virtual, and Xfera Móviles for a Loss of Confidentiality Related to Mobile Phone Sim Card Duplicate

Various claims are notified to Spanish Data Protection Authority (“Spanish DPA”) on the issuance of duplicate Subscriber Identity Module (“SIM”) cards to third parties other than subscribers. As a result, the holders of the telephone line are not only left without service, but the third parties access their bank accounts.

Spanish DPA find an assumption of using fraudulent practices based on the generation of duplicates of SIM cards without the consent of their legitimate holders in order to access confidential information for criminal purposes (known as "SIM Swapping").

Spanish DPA carries out research actions to analyze the procedures followed to manage SIM change requests by Orange Espagne S.A.U., Orange España Virtual S.L, and Xfera Móviles S.A., identifying the vulnerabilities that may exist in the implemented operating procedures, to detect the causes for which these cases could be occurring, as well as to find points of non-compliance, improvement or adjustment, to determine responsibilities, reduce risks and increase security in the processing of personal data of affected persons.

The data that is processed to issue a duplicate SIM card and the SIM card, which unequivocally identifies the subscriber on the network, is personal data, and their treatment must be subject to data protection regulations.

It has been verified that the measures implemented by Orange Espagne S.A.U., Orange España Virtual S.L, and Xfera Móviles S.A., were insufficient, so they generated a loss of confidentiality and the transfer of personal data to a third party.

The Spanish DPA imposes a total fine of 700,000 euros to Orange Espagne, 70,000 euros to Orange España Virtual, and 200,000 euros to Xfera Móviles for the infringement consisting of a lack of confidentiality.

You can reach further information about Orange Espana here, Orange España Virtual here and Xfera Móviles here.

 

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr