DIGI Spain Telecom, S.L. – €200,000 Fine (Spain, 2025)

In July 2023, a data subject filed a complaint with the DPA against DIGI Spain Telecom, S.L. (a telecommunications company, the controller). The data subject stated that, in October 2022, they were the holder of a mobile line with the controller. A distributor of the controller issued a duplicate SIM card to a third party without the data subject’s authorization, using a falsified identity document. The fraudster, with the duplicate SIM, accessed confidential data and carried out several bank transfers, withdrawing a significant amount of money. The controller later confirmed to the data subject that the duplicate had been processed with a manipulated ID card. The DPA found a violation of Article 6(1) GDPR. The DPA stated that the controller could not rely on any legal basis (in particular consent), because it duplicated the data subject's SIM card for a third party without the knowledge or consent of the data subject. The DPA emphasized that telecom operators must adopt robust identity verification protocols, especially for high-risk operations like SIM duplication, as the failure directly exposed the complainant to identity theft and financial fraud. The DPA fined the controller €200,000, and considered it a serious infringement of the GDPR. The DPA noted that the situation exposed the data subject to identity theft and fraud. The DPA also highlighted the particularly sensitive nature of ID data, as it identifies the data subject beyond doubt, and can easily be used to commit identity theft.