€1M GDPR Fine for Weak Call Center Identity Verification
Written by AI from the linked story. Not reviewed by an editor. How this works
Spain's AEPD imposed a €1,000,000 fine on an energy company after finding that its call center relied solely on static, easily obtainable customer data (such as name, address, or account number) to verify caller identity — with no multi-factor authentication in place. This approach violates GDPR Article 32, which requires organisations to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Critically, the absence of audit trails meant the company could not demonstrate compliance, compounding the regulatory breach. This case highlights that identity verification over voice channels is a significant attack vector and must be treated with the same rigour as digital authentication systems.
Tactical Insight
Immediate actions
- Replace static-data-only verification with multi-factor authentication for call center identity checks (e.g., one-time passcodes sent to registered devices).
- Implement and activate audit logging for all customer identity verification events in call center platforms.
Long-term improvements
- Develop and enforce a formal Identity Verification Policy that defines minimum assurance levels aligned with GDPR Article 32 requirements.
- Conduct regular third-party audits of call center authentication procedures to proactively identify compliance gaps.
- Integrate knowledge-based authentication with dynamic, non-public data points or biometric voice verification where feasible.
Detection & compliance measures
- Establish a continuous monitoring programme to review verification logs for anomalies such as repeated failed attempts or unusual access patterns.
- Map all customer authentication processes to GDPR obligations and maintain documented evidence of compliance for regulatory accountability.