# AEPD (Spain) - EXP202306073

- Type: News
- Source: GDPRhub
- Date: 2026-01-07
- Canonical: https://overview.legal/posts/51952
- Topics: Telecommunications, IP Address, Processing Agreement, Supervisory Authorities, Identification

## Summary

Facts: The Data Protection Authority has fined a telecommunications company €400,000 for unlawfully changing the ownership of a mobile phone subscription and issuing a dual SIM card without proper identity verification, violating [Article 6 of the GDPR], following a case of SIM card fraud. The Data Protection Authority has also fined a telecommunications provider €300,000 for unlawfully changing the ownership of a mobile phone subscription and issuing a dual SIM card to a third party who falsely presented themselves as a customer. According to the Data Protection Authority, the provider did not properly verify the customer's identity.

## Full text

Facts: The data protection authority (DPA) has fined a telecommunications company €400,000 for unlawfully changing the owner of a mobile phone subscription and issuing an identical SIM card without proper identity verification, violating [Article 6 of the GDPR], following a fraud case involving the exchange of a SIM card. The DPA has also fined a telecom provider €300,000 for unlawfully changing the owner of a mobile phone subscription and issuing an identical SIM card to a third party who pretended to be a customer. According to the DPA, the provider did not properly verify the customer's identity. Summary in English: Summary in English: --- *This content has been automatically translated using machine translation. The original version is available in the source language.* --- *This content was automatically translated using machine translation. The original version is available in the source language.*

## Cited law provisions (1)

### GDPR — gdpr-art-6-en

Lawfulness of processing

---
Generated by overview.legal · https://overview.legal/posts/51952 · 2026-08-22