BVwG - W292 2301903-1
Austrian court finds telco violated GDPR by failing to prevent identity fraud in contract processing.
Run Telecommunications provider?
Get an email when a reviewed story names Telecommunications provider, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Austrian Federal Administrative Court ruled that a telecommunications provider violated GDPR by not implementing adequate measures to prevent identity fraud. The provider allowed a third party to fraudulently obtain a mobile phone contract using a customer's personal data without proper identity verification, and failed to ensure data accuracy by not cross-referencing delivery addresses. The court rejected the provider's defense that the delivery company was solely responsible, emphasizing the controller's own obligations.
The lesson from this incident
Full lessonA telecommunications provider failed to implement adequate identity verification controls, allowing a fraudster to open a mobile contract using another person's personal data. The absence of cross-referencing mechanisms — such as comparing delivery addresses against registered customer data — meant the fraud went undetected. The Austrian Federal Administrative Court rejected the argument that the delivery company bore sole responsibility, affirming that data controllers cannot delegate away their own GDPR obligations. This case highlights that accountability under GDPR rests firmly with the controller, regardless of third-party involvement in the processing chain. Organisations that handle personal data for contract onboarding must treat identity verification as a core data protection control, not an afterthought.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.