[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbkcIUfIF1RIhMjlXGhm85HAJz5Qvdq-pjr6K-4huQdo":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":103},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"dfbf007d-deff-485c-85aa-1e8417a46490","BVwG - W292 2301903-1","bvwg-w292-2301903-1-43f59f","Created page with \"{{COURTdecisionBOX |Jurisdiction=Austria |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=BVwG |Court_Original_Name=Bundesverwaltungsgericht |Court_English_Name=Federal Administrative Court |Court_With_Country=BVwG (Austria) |Case_Number_Name=W292 2301903-1 |ECLI=ECLI:AT:BVWG:2026:W292.2301903.1.00 |Original_Source_Name_1=RIS |Original_Source_Link_1=https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=76c87077-765a-41a5-ba3f-5094c121a886&Position...\" Show changes","The Austrian Federal Administrative Court ruled that a telecommunications provider violated GDPR by not implementing adequate measures to prevent identity fraud. The provider allowed a third party to fraudulently obtain a mobile phone contract using a customer's personal data without proper identity verification, and failed to ensure data accuracy by not cross-referencing delivery addresses. The court rejected the provider's defense that the delivery company was solely responsible, emphasizing the controller's own obligations.","Austrian court finds telco violated GDPR by failing to prevent identity fraud in contract processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W292_2301903-1&diff=53408&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-14T17:53:27+00:00","2026-10-14T18:00:16.095042+00:00",7,[17],{"name":18,"type":19},"Telecommunications provider","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":22,"name":23,"slug":24},null,"GDPR","gdpr",[26,28,33,38],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":102},[47,76],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":77,"name":78,"problem":79,"products":80},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[81,89,94],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":90,"product_name":91,"url":92,"description":93},"defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",[],{"slug":104,"title":105,"body":106,"framework_refs":107,"framework_notes":120},"telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","A telecommunications provider failed to implement adequate identity verification controls, allowing a fraudster to open a mobile contract using another person's personal data. The absence of cross-referencing mechanisms — such as comparing delivery addresses against registered customer data — meant the fraud went undetected. The Austrian Federal Administrative Court rejected the argument that the delivery company bore sole responsibility, affirming that data controllers cannot delegate away their own GDPR obligations. This case highlights that accountability under GDPR rests firmly with the controller, regardless of third-party involvement in the processing chain. Organisations that handle personal data for contract onboarding must treat identity verification as a core data protection control, not an afterthought.",[108,109,110,111,112,113,114,115,116,117,118,119],"GDPR Article 5(1)(d) — Data Accuracy Principle","GDPR Article 5(2) — Accountability Principle","GDPR Article 24 — Responsibility of the Controller","GDPR Article 25 — Data Protection by Design and by Default","GDPR Article 32 — Security of Processing","GDPR Article 33 — Notification of Personal Data Breach","NIST SP 800-63-3 — Digital Identity Guidelines","NIST AC-2 — Account Management","NIST IA-12 — Identity Proofing","CIS Control 6 — Access Control Management","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 — A.5.34 Privacy and Protection of PII",{}]