Editing AEPD (Spain) - PS/00308/2021 (section)

== English Summary ==

=== Facts ===
A data subject filed a complaint with the Spanish DPA (AEPD). The complainant had started a phone number portability from one telecommunication company (Yoigo) to another one (MasMovil). However, the complainant regretted it and asked the company to stop and cancel the portability (before the new SIM card arrived). Something went wrong during the process, as the complainant did not have phone signal during a few days. Yoigo answered that they would solve the issue and send the complainant a new SIM card. 

Two days later, the complainant found that someone had been using their phone number to make bank transfers via a phone application called Bizum, that offers the possibility of making bank transfers using your phone number.

The complainant suspected that this had happened for reasons related with the portability problem, and contacted Yoigo, that answered that the SIM card had been destroyed.

Afterwards, the complainant discovered that their phone number was on Orange (another telecommunications company), but no longer in the complainant's name.

The complainant hence reported this to the police and filed the complaint with the DPA.

The AEPD launched an investigation and received an answer by Xfera Moviles (owned by MasMovil) saying that a scammer had been trying to make a fake portability several times, and had been stopped by the automated systems against fraud, but that they had been successful the last time they tried to, arranging a portability with Orange for the phone number of the complainant. 
=== Holding ===
The AEPD concluded that Orange had not put into place all the necessary and adequate measures to avoid unlawfully processing personal data, since they had no proper identity verification system for portability requests.

Therefore, the AEPD fined Orange €50,000 for a violation of [[Article 6 GDPR|Article 6 GDPR]], for the processing of personal data without a valid legal basis.

The fine was reduced to €30,000 for the acknowledgement of responsibility and early payment.