BVwG - W292 2301903-1
Austrian court rules telco violated GDPR by failing to prevent identity fraud during contract conclusion.
Run telecommunications provider?
Get an email when a reviewed story names telecommunications provider, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Austrian Federal Administrative Court ruled that a telecommunications provider violated GDPR articles related to data accuracy, integrity, and security. The provider failed to implement adequate measures to prevent identity fraud when processing personal data for mobile phone contracts, specifically by not verifying the customer's identity or delivery address sufficiently. The court rejected the provider's defense that personal delivery with an identity check was adequate, emphasizing the controller's ongoing obligations.
The lesson from this incident
Full lessonAn Austrian telecommunications provider was found liable under GDPR for failing to implement sufficient identity verification controls when issuing mobile phone contracts, allowing fraudsters to exploit the process using others' personal data. The root issue was inadequate procedural and technical safeguards around identity proofing — relying solely on post-issuance delivery checks rather than robust upfront verification. This violated GDPR Articles requiring data accuracy, integrity, and appropriate security measures for personal data processing. The ruling reinforces that controllers bear ongoing responsibility for the integrity of personal data throughout the entire contract lifecycle, not just at a single touchpoint. Weak identity verification is not just a fraud risk — it is a data protection compliance failure with significant legal consequences.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.