[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foGkuHidJANi-XW5fjo6e7YeZ30biDci5u4f3xstg1a4":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":104},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"2aaa701b-65ba-48ad-bd84-ca34ae356947","BVwG - W292 2301903-1","bvwg-w292-2301903-1-0b1465","Forgot a link. ← Older revision Revision as of 17:59, 14 October 2026 (One intermediate revision by the same user not shown) Line 112: Line 112: }} }} The court held that a telecommunications provider violated Articles 5(1)(d) and 5(1)(f) GDPR by failing to implement adequate measures to prevent identity fraud when processing a data subject’s personal data to conclude a mobile phone contract. The court held that a telecommunications provider violated [[Article 5 GDPR|Articles 5(1)(d) and (f)]], [[Article 24 GDPR|24]] and [[Article 32 GDPR|32 GDPR]] by failing to implement adequate measures to prevent identity fraud when processing a data subject’s personal data to conclude a mobile phone contract. == English Summary == == English Summary == Line 128: Line 128: The DPA upheld the complaint. The controller appealed to the Austrian Federal Administrative Court. The DPA upheld the complaint. The controller appealed to the Austrian Federal Administrative Court. === Holding === === Holding === First, the court held that the controller had violated [[Article 5 GDPR|Article 5(f) GDPR]], [[Article 24 GDPR|Article 24 GDPR]] and [[Article 32 GDPR|Article 32 GDPR]] by failing to implement adequate technical and organisational measures to prevent identity fraud. First, the court held that the controller had violated [[Article 5 GDPR|Article 5(f) GDPR]], [[Article 24 GDPR]] and [[Article 32 GDPR]] by failing to implement adequate technical and organisational measures to prevent identity fraud. Second, the court held that the controller had violated [[Article 5 GDPR|Article 5(1)(d) GDPR]], which requires controllers to ensure the accuracy of personal data. By failing to verify the data subject’s identity or check the delivery address against the information already held for this existing customer, the controller had failed to take adequate measures to ensure data accuracy. Second, the court held that the controller had violated [[Article 5 GDPR|Article 5(1)(d) GDPR]], which requires controllers to ensure the accuracy of personal data. By failing to verify the data subject’s identity or check the delivery address against the information already held for this existing customer, the controller had failed to take adequate measures to ensure data accuracy. Line 137: Line 135: Third, the court rejected the controller’s argument that arranging personal delivery with an identity check was sufficient. The controller had not convincingly explained how it monitored compliance with the personal delivery requirement. Relying on the delivery company’s contractual obligation to verify the recipient’s identity did not affect the controller’s own obligations. Third, the court rejected the controller’s argument that arranging personal delivery with an identity check was sufficient. The controller had not convincingly explained how it monitored compliance with the personal delivery requirement. Relying on the delivery company’s contractual obligation to verify the recipient’s identity did not affect the controller’s own obligations. Finally, the court upheld the DPA's finding that the controller had infringed the data subject’s right to confidentiality under § 1 DSG, read together with [[Article 5 GDPR|Article 5(1)(d) GDPR]], [[Article 5 GDPR|Article 5(1)(f) GDPR]], [[Article 24 GDPR|Article 24 GDPR]] and [[Article 32 GDPR|Article 32 GDPR]]. It dismissed the appeal and held that a further appeal was inadmissible. Finally, the court upheld the DPA's finding that the controller had infringed the data subject’s right to confidentiality under [https:\u002F\u002Fwww.ris.bka.gv.at\u002FGeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 1 DSG], read together with [[Article 5 GDPR|Article 5(1)(d) GDPR]], [[Article 5 GDPR|Article 5(1)(f) GDPR]], [[Article 24 GDPR]] and [[Article 32 GDPR]]. It dismissed the appeal and held that a further appeal was inadmissible. == Comment == == Comment == The court referred to the CJEU’s judgment in the case C-340\u002F21. The court referred to the CJEU’s judgment in the case [https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FSUM\u002F?uri=celex:62021CJ0340 C-340\u002F21]. The court acknowledged that the delivery company could potentially be regarded as a joint controller for the relevant processing, which could give rise to claims under [[Article 82 GDPR|Article 82 GDPR]]. However, it did not conclusively determine the delivery company’s status or decide any claim for compensation. The court acknowledged that the delivery company could potentially be regarded as a joint controller for the relevant processing, which could give rise to claims under [[Article 82 GDPR]]. However, it did not conclusively determine the delivery company’s status or decide any claim for compensation. == Further Resources == == Further Resources ==","The Austrian Federal Administrative Court ruled that a telecommunications provider violated GDPR articles related to data accuracy, integrity, and security. The provider failed to implement adequate measures to prevent identity fraud when processing personal data for mobile phone contracts, specifically by not verifying the customer's identity or delivery address sufficiently. The court rejected the provider's defense that personal delivery with an identity check was adequate, emphasizing the controller's ongoing obligations.","Austrian court rules telco violated GDPR by failing to prevent identity fraud during contract conclusion.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W292_2301903-1&diff=53410&oldid=53408","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-14T17:59:00+00:00","2026-10-14T18:00:16.095042+00:00",7,[17],{"name":18,"type":19},"telecommunications provider","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":44,"vendors":103},[45,74],{"slug":46,"name":47,"problem":48,"products":49},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":75,"name":76,"problem":77,"products":78},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",[],{"slug":105,"title":106,"body":107,"framework_refs":108,"framework_notes":119},"telco-fined-for-failing-to-verify-identities-enabling-gdpr-violating-fraud","Telco Fined for Failing to Verify Identities, Enabling GDPR-Violating Fraud","An Austrian telecommunications provider was found liable under GDPR for failing to implement sufficient identity verification controls when issuing mobile phone contracts, allowing fraudsters to exploit the process using others' personal data. The root issue was inadequate procedural and technical safeguards around identity proofing — relying solely on post-issuance delivery checks rather than robust upfront verification. This violated GDPR Articles requiring data accuracy, integrity, and appropriate security measures for personal data processing. The ruling reinforces that controllers bear ongoing responsibility for the integrity of personal data throughout the entire contract lifecycle, not just at a single touchpoint. Weak identity verification is not just a fraud risk — it is a data protection compliance failure with significant legal consequences.",[109,110,111,112,113,114,115,116,117,118],"GDPR Article 5(1)(d) – Data Accuracy","GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 5(2) – Accountability","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 32 – Security of Processing","NIST SP 800-63-3 – Digital Identity Guidelines","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","NIST PR.AC-1 – Identities and credentials are managed for authorized devices and users","ISO\u002FIEC 27001:2022 – A.5.17 Authentication Information",{}]