Enforcement · AEPD ·EXP202306073 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

AEPD fines two telecom providers €400,000 and €300,000 for SIM card fraud

Original title: AEPD (Spain) - EXP202306073

€400,000 Fine
Spain
Telecommunications IP Address Identification Supervisory Authorities Processing Agreement
Jan 7, 2026
Summary

Facts: The Data Protection Authority has fined a telecommunications company €400,000 for unlawfully changing the ownership of a mobile phone subscription and issuing a dual SIM card without proper identity verification, violating [Article 6 of the GDPR], following a case of SIM card fraud. The Data Protection Authority has also fined a telecommunications provider €300,000 for unlawfully changing the ownership of a mobile phone subscription and issuing a dual SIM card to a third party who falsely presented themselves as a customer. According to the Data Protection Authority, the provider did not properly verify the customer's identity.

Full text

Facts: The data protection authority (DPA) has fined a telecommunications company €400,000 for unlawfully changing the owner of a mobile phone subscription and issuing an identical SIM card without proper identity verification, violating [Article 6 of the GDPR], following a fraud case involving the exchange of a SIM card. The DPA has also fined a telecom provider €300,000 for unlawfully changing the owner of a mobile phone subscription and issuing an identical SIM card to a third party who pretended to be a customer. According to the DPA, the provider did not properly verify the customer's identity. Summary in English: Summary in English: --- This content has been automatically translated using machine translation. The original version is available in the source language. --- This content was automatically translated using machine translation. The original version is available in the source language.

How it connects

References

Related across sources

3 O 762/19 LG Rostock: Pre-ticked cookie consent boxes invalid under Art 6(1)(a) GDPR The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit… Sep 15, 2020 Consent Legitimate Interest Controllers
C-293/12 Digital Rights Ireland Ltd v Minister for Communications C-293/12 (Digital Rights Ireland) CJEU Apr 8, 2014 IP Address Storage Limitation Right to be Forgotten
Opinion 5/2019 interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities Opinion ·EDPB Mar 12, 2019 Telecommunications Material scope (GDPR) Supervision
C-40/17 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV C-40/17 (Fashion ID) CJEU Jul 29, 2019 Controllers Legitimate Interest Processors
C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer
C-319/20 Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV The CJEU ruled on a preliminary reference from the German Federal Court of Justice in proceedings between Meta Platforms Ireland Limited and the Verbraucherzentrale Bundesverband… CJEU ·Third Chamber Apr 28, 2022 Personal Data IP Address Legitimate Interest
Related documents