Sanction of the operator Orange España: lack of verification the identity of the person concerned

Sanction of the operator Orange España: lack of verification the identity of the person concerned
Maëva Vidal

The Spanish Data Protection Agency (AEPD) has fined Orange Spain €30,000 for illegally registering a telephone line in the name of a customer without verifying the customer's identity.

The facts

An individual files a complaint against the company for having registered a telephone line in his name without his consent.

He claims to have been a victim of identity theft. He received a call from the Granada police informing him that a fraudulent crime had been committed with the phone number in question.

He accused the company of having introduced the personal data into its information systems without verifying the identity of the person who contracted.

As a reminder, Article 6.1 of the General Data Protection Regulation (GDPR) states that there are six possible legal bases for data processing, one of which is the consent of the person (Art. 6.1.a).

The AEPD considered that the company violated the lawfulness of the processing of personal data, since it formalized a cell phone contract, using the complainant as the holder of the contract, without duly verifying the complainant's data, which resulted in the impersonation of the complainant.

This being the case, Orange Spain violated Article 6.1 of the GDPR, which ensures that personal data is processed lawfully, since it didn't have the consent of the data subject.

The company should have verified the identity of the customer to ensure consent.


Subscribe to our newsletter

We will send you a few emails to keep you informed of our news and what's new in our solution*

*You will always be able to unsubscribe on each newsletter. Learn more.

The protection of personal data: a necessary defense for the individual in case of abuse

The AEPD sanctioned a property syndicate for including, without consent, the phone number in the WhatsApp application, and for not respondin...

Maëva Vidal

CJEU ruling against Google: Right to oblivion extended against manifestly inaccurate information

In a ruling dated December 8, 2022, the Court of Justice of the European Union (CJEU) states that the search engine operator must dereferenc...

Margaux Morel

Update 1.5.0 : customs fields!

New version of Dastra incorporating custom fields!

Antoine Bidault

A small step for DPOs, a big step for data protection is free to try, easy to set up, and work seamlessly together.

Startup for free Ask for a demo

Free 30 day trial - No credit card required - No commitment