[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGmqVUIBw0pADELuqPNcbL4B1owuXOyFqhPeEbZDmGzY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"6b124f49-ebbd-497d-b846-1a5387470265","telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","dfbf007d-deff-485c-85aa-1e8417a46490","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","A telecommunications provider failed to implement adequate identity verification controls, allowing a fraudster to open a mobile contract using another person's personal data. The absence of cross-referencing mechanisms — such as comparing delivery addresses against registered customer data — meant the fraud went undetected. The Austrian Federal Administrative Court rejected the argument that the delivery company bore sole responsibility, affirming that data controllers cannot delegate away their own GDPR obligations. This case highlights that accountability under GDPR rests firmly with the controller, regardless of third-party involvement in the processing chain. Organisations that handle personal data for contract onboarding must treat identity verification as a core data protection control, not an afterthought.","**Immediate actions:**\n- Implement multi-factor identity verification (e.g., document checks, address matching) for all new contract sign-ups before processing personal data.\n- Audit current onboarding workflows to identify gaps where third-party delivery addresses are not cross-referenced against customer records.\n\n**Long-term improvements:**\n- Establish formal data accuracy policies under GDPR Article 5(1)(d) requiring automated cross-checks of personal data at point of collection and contract fulfilment.\n- Conduct Data Protection Impact Assessments (DPIAs) for all customer onboarding processes that involve third-party service providers.\n- Define clear contractual obligations with delivery and fulfilment partners specifying their identity verification responsibilities and liability boundaries.\n\n**Detection & response measures:**\n- Deploy anomaly detection alerts for mismatches between registered customer addresses and delivery destinations.\n- Establish a dedicated incident response process for suspected identity fraud cases, including customer notification and regulatory reporting timelines under GDPR Article 33.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 5(1)(d) — Data Accuracy Principle","GDPR Article 5(2) — Accountability Principle","GDPR Article 24 — Responsibility of the Controller","GDPR Article 25 — Data Protection by Design and by Default","GDPR Article 32 — Security of Processing","GDPR Article 33 — Notification of Personal Data Breach","NIST SP 800-63-3 — Digital Identity Guidelines","NIST AC-2 — Account Management","NIST IA-12 — Identity Proofing","CIS Control 6 — Access Control Management","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 — A.5.34 Privacy and Protection of PII",{},"published","2026-10-14T18:20:33.853844+00:00","2026-10-14T18:20:33.817+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W292_2301903-1&diff=53408&oldid=0","bvwg-w292-2301903-1-43f59f","BVwG - W292 2301903-1",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[53,57],{"slug":54,"name":55,"problem":56},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":58,"name":59,"problem":60},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]