[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fayQbfPElaG2kbBlaQWvLL77gG5RNd6Yzii6UzG8eRv4":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":95},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"a5ea04f4-2132-4b17-b251-cf0039bdaec3","AEPD (Spain) - ps-00148-2025","aepd-spain-ps-00148-2025-ba1efb","← Older revision Revision as of 13:32, 13 August 2026 (2 intermediate revisions by the same user not shown) Line 13: Line 13: |Original_Source_Name_1=AEPD |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00148-2025.pdf |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00148-2025.pdf |Original_Source_Language_1= |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1= |Original_Source_Language__Code_1=ES","Spain's AEPD has fined telecom provider XFERA MÓVILES €200,000 for violating Article 6(1) of the GDPR. The company issued a duplicate SIM card to an unauthorized third party who presented a forged identity document, failing to adequately verify the individual's identity. The DPA ruled that the contractual relationship did not legitimize processing based on a fraudulent request.","Spain's AEPD fines XFERA MÓVILES €200,000 for GDPR violation over SIM card issuance.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-00148-2025&diff=52691&oldid=52688","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-08-13T13:32:36+00:00","2026-08-13T14:00:16.62238+00:00",7,[17],{"name":18,"type":19},"XFERA MÓVILES","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":94},[47,76],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":77,"name":78,"problem":79,"products":80},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[81,86],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":82,"product_name":83,"url":84,"description":85},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":96,"title":97,"body":98,"framework_refs":99,"framework_notes":110},"sim-swap-fraud-costs-telecom-200k-under-gdpr","SIM Swap Fraud Costs Telecom €200K Under GDPR","XFERA MÓVILES failed to implement adequate identity verification controls before issuing a duplicate SIM card, allowing a fraudster with a forged document to take over a customer's mobile identity. This SIM-swap attack is a well-known vector for account takeover, enabling downstream fraud such as bypassing SMS-based multi-factor authentication. The AEPD ruled that a contractual basis for data processing cannot be claimed when the request itself is fraudulent, meaning weak verification processes directly invalidate legal justification under GDPR Article 6(1). Telecoms and any organization handling sensitive customer requests must treat identity verification as a critical security control, not a formality. This case underscores that GDPR liability extends beyond data breaches to improper processing triggered by inadequate procedural safeguards.",[100,101,102,103,104,105,106,107,108,109],"GDPR Article 6(1) — Lawfulness of processing","GDPR Article 5(1)(f) — Integrity and confidentiality","GDPR Article 24 — Responsibility of the controller","NIST SP 800-63-3 — Digital Identity Guidelines (IAL2\u002FIAL3)","NIST AC-2 — Account Management","NIST AC-17 — Remote Access","CIS Control 6 — Access Control Management","CIS Control 14 — Security Awareness and Skills Training","ENISA Telecom Security Guidelines — Customer Authentication","ISO\u002FIEC 27001:2022 — A.5.17 Authentication information",{}]