AEPD (Spain) - PS/00308/2021
|AEPD (Spain) - PS/00308/2021|
|Relevant Law:||Article 6 GDPR|
|Parties:||ORANGE ESPAGNE, S.A.U.|
|National Case Number/Name:||PS/00308/2021|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
The Spanish DPA fined Orange €50,000 (reduced to €30,000) for processing personal data without a valid legal basis, since processing was based on a fraudulent telephone portability contract. The DPA stated that Orange did not have an adequate identity verification system for portability requests.
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject filed a complaint with the Spanish DPA (AEPD). The complainant had started a phone number portability from one telecommunication company (Yoigo) to another one (MasMovil). However, the complainant regretted it and asked the company to stop and cancel the portability (before the new SIM card arrived). Something went wrong during the process, as the complainant did not have phone signal during a few days. Yoigo answered that they would solve the issue and send the complainant a new SIM card.
Two days later, the complainant found that someone had been using their phone number to make bank transfers via a phone application called Bizum, that offers the possibility of making bank transfers using your phone number.
The complainant suspected that this had happened for reasons related with the portability problem, and contacted Yoigo, that answered that the SIM card had been destroyed.
Afterwards, the complainant discovered that their phone number was on Orange (another telecommunications company), but no longer in the complainant's name.
The complainant hence reported this to the police and filed the complaint with the DPA.
The AEPD launched an investigation and received an answer by Xfera Moviles (owned by MasMovil) saying that a scammer had been trying to make a fake portability several times, and had been stopped by the automated systems against fraud, but that they had been successful the last time they tried to, arranging a portability with Orange for the phone number of the complainant.
Holding[edit | edit source]
The AEPD concluded that Orange had not put into place all the necessary and adequate measures to avoid unlawfully processing personal data, since they had no proper identity verification system for portability requests.
Therefore, the AEPD fined Orange €50,000 for a violation of Article 6 GDPR, for the processing of personal data without a valid legal basis.
The fine was reduced to €30,000 for the acknowledgement of responsibility and early payment.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/12 File No.: PS / 00308/2021 RESOLUTION OF TERMINATION OF THE PROCEDURE BY PAYMENT VOLUNTARY Of the procedure instructed by the Spanish Agency for Data Protection and based on to the following BACKGROUND FIRST: On July 9, 2021, the Director of the Spanish Agency for Data Protection agreed to initiate a sanctioning procedure against ORANGE ESPAGNE, S.A.U. (hereinafter, the claimed party), through the Agreement that is transcribed: << Procedure No.: PS / 00308/2021 AGREEMENT TO START THE SANCTIONING PROCEDURE Of the actions carried out by the Spanish Agency for Data Protection and in based on the following ACTS FIRST: A.A.A. (hereinafter, the claimant) dated March 17, 2020 filed a claim with the Spanish Data Protection Agency. The claim is directed against ORANGE ESPAGNE, S.A.U., with CIF A82009812 (in forward, the claimed one). C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 2/12 The reasons on which the claim is based are that on February 26, 2020, the claimant requested the portability of YOIGO to MASMOVIL, and although the next day telephonically canceled the portability carried out, one of the lines (*** PHONE. 1) was retained in MASMOVIL, despite assuring it that said portability was voided (so the SIM card was not delivered). On March 05, 2020, you do not have a mobile phone line, contact YOIGO and they will tell you that will solve it. On March 11, 2020, YOIGO sends you a new SIM card indicating that they would reactivate the service in 48 hours. Two days later (March 13, 2020), you discover that third parties are making unauthorized, high-value bank transfers from your account of BBVA (two of them by reimbursement by Bizum). Contact MASMOVIL, as you suspect that what happened has its cause in the disappearance of your SIM card and indicate that your card may have been destroyed by the carrier for security reasons. Who later discovers that his number *** TELEPHONE.1 belongs to Orange since March 13, 2020 and that it is not in your name. Along with the claim, provide a copy of the complaint to the police SECOND: In view of the facts denounced in the claim and the documents provided by the claimant, the Subdirectorate General for Inspection of Data proceeded to carry out preliminary investigation actions for the clarification of the facts in question, by virtue of the powers of investigation granted to the control authorities in article 57.1 of the Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD), and of in accordance with the provisions of Title VII, Chapter I, Second Section, of the Law Organic 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights (hereinafter LOPDGDD). C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/3 As a result of the investigative actions carried out, it is verified that the responsible for the treatment is the claimed one. Likewise, the following points are found: On July 14, 2020, XFERA MÓVILES, S.A., sent this Agency the following information and statements: 1. That from February 26, 2020 to March 5, 2020 are received repeated requests for portability of the claimant's line, which are all ex officio shutdowns in systems due to fraud. This is possible because the operator donor and recipient (from YOIGO to MASMOVIL) belonged to the same company. 2. That the scammer's fourth attempt was not possible to stop the portability in the systems (portability times are very short), but stopped in logistics of so the SIM card was not delivered. 3. That the scammer tried portability again on 03/13/2020 and manages to carry out the portability, this time to the ORANGE company, so he had to pass the security of this company. On February 6, 2021, ORANGE ESPAGNE, S.A.U. sends this Agency the following information and statements: 1. That the request to the donor operator regarding portability was completed through the shared system SGP with the data corresponding to the claimant and was accepted by the donor operator. Provides a screenshot of a portability request dated February 13 March 2020 relative to the line *** PHONE. 1 and being name and surname and number The client's DNI those of the claimant. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 4/12 2. That the portability was done through the Online channel. 3. That they proceeded to inform by sending an SMS to the line object of portability as of March 12, 2020 with the following content: "Hello. you already have your order *** ORDER.1 in the store *** STORE.1 you have 7 days to come and pick it up Remember to bring the necessary documentation to pick up your order. that you can check in *** URL.1. In case of not taking it, we will not be able to deliver. And if you have not yet taken out Orange mobile insurance for your smartphone or tablet, ask for it in your store to protect it from theft / breakage *** URL.2 " A copy of the sms is provided. 4. Provide a copy of the DNI that served to prove the identity of the client stating in it the name of D. B.B.B. with DNI number *** NIF. 1. 5. A copy of the portability contract is provided where it appears: to. In the "Orange customer data" section there is B.B.B. with DNI number *** NIF. 1. b. The e-mail contains *** EMAIL. 1. c. In the "data of the owner of the donor operator line" section the Name and surname of the claimant with DNI number *** NIF.1. d. There is an indication of "Accepted by the customer electronically or by phone date 03-11-2020 14:08:42 ”by both the Orange client and the operator client donor. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 5/12 6. That the line *** TELEPHONE.1 was blocked, putting it at disposition of the claimant again. 7. That checks are being carried out to clarify what happened, as well how to apply the corresponding internal measures since the controls applied by the company in relation to verification of the identity of the contractor they were applied correctly. 8. That in recent months they have focused their efforts on implementing systems and measures to ensure the identity verification of the holder. That have as technologies already implemented the “Digital Signature” tool, which is software that allows to check if the DNI is in force, if it is one of those admitted by the policy of Orange or if it generates doubts for having non-matching data. They also have the "MobileConnect" tool for sending challenge / sms with a message that the customer you must accept on your device to continue with the management. 9. That, in response to the security mechanisms used to ensure the authenticity of the data provided by the client, as well as to verify their ownership of the line state that the SGP request to the donor operator with the data indicated by the user was validated and accepted by the donor operator. That Likewise, the communications indicated above were sent. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in articles 47 and 48 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and to solve this procedure. II Organic Law 3/2018, of December 5, on the Protection of Personal Data and C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 6/12 guarantee of digital rights, in its article 4.11 defines the consent of the interested as “any manifestation of free will, specific, informed and unequivocal by which the interested party accepts, either through a declaration or a clear affirmative action, the processing of personal data that concerns you ”. In this sense, article 6.1 of the RGPD establishes that “in accordance with provided in article 4.11 of Regulation (EU) 2016/679, it is understood by consent of the affected party any manifestation of free, specific will, informed and unequivocal by which it accepts, either through a statement or a clear affirmative action, the processing of personal data that concerns him ”. III In accordance with the available evidence, it is considered that, of the denounced facts, a data processing without legitimation is deduced, since the claimed entity carried out the portability object of this complaint, without ascertaining whether the The person requesting it was or was not the claimant, which is a violation of the Article 6 of the RGPD. In relation to the lack of security measures in the deliveries of Sim cards reported, indicate that a response is being given through the procedure sanctioner PS / 0022/2021 still in progress. IV Article 72.1 b) of the LOPDGDD states that “depending on what is established in the Article 83.5 of Regulation (EU) 2016/679, are considered very serious and will prescribe At three years, the infractions that suppose a substantial violation of the articles mentioned in that and in particular, the following: c) The processing of personal data without any of the conditions of legality of the treatment in article 6 of Regulation (EU) 2016/679. " C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 7/12 V Article 58.2 of the RGPD provides the following: “Each control authority will have of all of the following corrective powers listed below: b) direct a warning to any person in charge or in charge of the treatment when the processing operations have infringed the provisions of this Regulation; d) order the person in charge of the treatment that the operations of treatment comply with the provisions of this Regulation, where appropriate, in a certain way and within a specified time frame; i) impose an administrative fine in accordance with article 83, in addition to or instead of the measures mentioned in this section, according to the circumstances of each case particular; SAW This offense can be sanctioned with a fine of € 20,000,000 maximum or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global business volume of the previous financial year, opting for the of greater amount, in accordance with article 83.5 of the RGPD. Likewise, it is considered that the sanction to be imposed should be adjusted in accordance with the following criteria established in article 83.2 of the RGPD: As aggravating factors the following: In the present case we are dealing with unintentional negligent action, but significant you identified (article 83.2 b) C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/8 Basic personal identifiers -image- are affected (art 83.2 g) Therefore, based on the foregoing, By the Director of the Spanish Data Protection Agency, HE REMEMBERS: FIRST: INITIATE SANCTIONING PROCEDURE against ORANGE ESPAGNE, S.A.U., with CIF A82009812, in accordance with the provisions of article 58.2.b) of the RGPD, for the alleged violation of article 6 of the RGPD, typified in article 83.5.b) of the GDPR SECOND: ORDER ORANGE ESPAGNE, S.A.U., with CIF A82009812, of in accordance with the provisions of article 58.2 d) of the RGPD, so that within ten days proceed to carry out the necessary actions so that the treatment of the data The personal data used comply with the provisions of the GDPR. THIRD: APPOINT C.C.C. as instructor. and, as secretary, to D.D.D., indicating that any of them may be challenged, if applicable, in accordance with the established in articles 23 and 24 of Law 40/2015, of October 1, on the Regime Public Sector Legal (LRJSP). FOURTH: INCORPORATE to the sanctioning file, for evidentiary purposes, the claim filed by the claimants and their documentation, the documents obtained and generated by the General Subdirectorate for Data Inspection during the investigation phase, as well as the report of previous Inspection actions. FIFTH: THAT for the purposes provided for in art. 64.2 b) of Law 39/2015, of 1 October, of the Common Administrative Procedure of Public Administrations, the The corresponding penalty would be 50,000 euros (fifty thousand euros) without detriment of what results from the instruction. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 9/12 SIX: NOTIFY this agreement ORANGE ESPAGNE, S.A.U., with CIF A82009812, granting a hearing period of ten business days to formulate the allegations and present the evidence that it deems appropriate. In his writing of allegations, you must provide your NIF and the procedure number that appears in the heading of this document. If within the stipulated period it does not make allegations to this initiation agreement, the same may be considered a resolution proposal, as established in article 64.2.f) of Law 39/2015, of October 1, on the Common Administrative Procedure of the Public Administrations (hereinafter, LPACAP). In accordance with the provisions of article 85 of the LPACAP, in the event that the penalty to be imposed would be a fine, you may recognize your responsibility within the term granted for the formulation of allegations to the present initiation agreement; it which will entail a reduction of 20% of the penalty to be imposed in the present procedure. With the application of this reduction, the sanction would be established at € 2,400 (two thousand four hundred euros), resolving the procedure with the imposition of this sanction. In the same way, you may, at any time prior to the resolution of this procedure, carry out the voluntary payment of the proposed sanction, which will mean a reduction of 20% of its amount. With the application of this reduction, the penalty would be set at € 40,000 (forty thousand four hundred euros), and its payment will imply the termination of the procedure. The reduction for the voluntary payment of the penalty is cumulative to the corresponding apply for the acknowledgment of responsibility, provided that this acknowledgment of the responsibility is made manifest within the period granted to formulate allegations at the opening of the procedure. The voluntary payment of the referred amount in the preceding paragraph, it may be done at any time prior to the resolution. In In this case, if both reductions should be applied, the amount of the penalty would be set at € 30,000 (thirty thousand euros). C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 10/12 In any case, the effectiveness of either of the two mentioned reductions will be conditioned to the withdrawal or resignation of any action or remedy in administrative against the sanction. In case you choose to proceed to the voluntary payment of any of the amounts mentioned above € 40,000 or € 30,000, you must make it effective through your deposit in the account number ES00 0000 0000 0000 0000 0000 opened in the name of the Spanish Agency for Data Protection in Banco CAIXABANK, S.A., indicating in the concept the reference number of the procedure that appears in the heading of this document and the cause of reduction of the amount to which welcomes. Likewise, you must send the proof of admission to the Subdirectorate General of Inspection to continue the procedure according to the quantity entered. The procedure will have a maximum duration of nine months from the date of date of the initiation agreement or, where appropriate, the draft initiation agreement. After this period, its expiration will occur and, consequently, the file of performances; in accordance with the provisions of article 64 of the LOPDGDD. Finally, it is pointed out that in accordance with the provisions of article 112.1 of the LPACAP, There is no administrative appeal against this act. Mar Spain Martí Director of the Spanish Agency for Data Protection >> SECOND: On August 4, 2021, the claimed party has made the payment of the penalty in the amount of 30,000 euros making use of the two reductions provided for in the Initiation Agreement transcribed above, which implies the acknowledgment of responsibility. C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 11/12 THIRD: The payment made, within the period granted to formulate allegations to the opening of the procedure, entails the waiver of any action or appeal in the process administrative against the sanction and the recognition of responsibility in relation to the facts to which the Initiation Agreement refers. FOUNDATIONS OF LAW I By virtue of the powers that article 58.2 of the RGPD recognizes to each authority of control, and as established in art. 47 of Organic Law 3/2018, of 5 of December, Protection of Personal Data and guarantee of digital rights (in hereinafter LOPDGDD), the Director of the Spanish Agency for Data Protection is competent to sanction the infractions that are committed against said Regulation; infractions of article 48 of Law 9/2014, of May 9, General of Telecommunications (hereinafter LGT), in accordance with the provisions of the article 84.3 of the LGT, and the offenses typified in articles 38.3 c), d) and i) and 38.4 d), g) and h) of Law 34/2002, of July 11, on services of the company of the information and electronic commerce (hereinafter LSSI), as provided in article 43.1 of said Law. II Article 85 of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations (hereinafter, LPACAP), under the rubric "Termination of sanctioning procedures" provides the following: "1. Initiated a sanctioning procedure, if the offender acknowledges his responsibility, the procedure may be resolved with the imposition of the appropriate sanction. 2. When the sanction is solely of a pecuniary nature or it is possible to impose a pecuniary sanction and other non-pecuniary sanction but the inadmissibility of the second, the voluntary payment by the presumed responsible, in any time prior to the resolution, will imply the termination of the procedure, except in relation to the replacement of the altered situation or to the determination of the compensation for damages caused by the commission of the offense. 3. In both cases, when the sanction is solely of a pecuniary nature, the competent body to resolve the procedure will apply reductions of, at least, 20% on the amount of the proposed sanction, these being cumulative among themselves. The aforementioned reductions must be determined in the notice of initiation of the procedure and its effectiveness will be conditional on the withdrawal or resignation of any action or appeal in administrative proceedings against the sanction. The percentage of reduction foreseen in this section may be increased regulations. " C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 12/12 In accordance with the above, the Director of the Spanish Agency for the Protection of Data RESOLVES: FIRST: DECLARE the termination of procedure PS / 00308/2021, of in accordance with the provisions of article 85 of the LPACAP. SECOND: NOTIFY this resolution to ORANGE ESPAGNE, S.A.U .. In accordance with the provisions of article 50 of the LOPDGDD, this Resolution will be made public once it has been notified to the interested parties. Against this resolution, which puts an end to the administrative procedure as prescribed by the art. 114.1.c) of Law 39/2015, of October 1, on Administrative Procedure Common of Public Administrations, interested parties may file an appeal administrative litigation before the Contentious-Administrative Chamber of the National High Court, in accordance with the provisions of article 25 and section 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Contentious-Administrative Jurisdiction, within a period of two months from the day following notification of this act, as provided in article 46.1 of the referred Law. 936-160721 Mar Spain Martí Director of the Spanish Agency for Data Protection C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es