Cybersecurity Policy Report, Garante Fines Phone Provider for Improper Processing Under GDPR, (May 9, 2024)

By Tony Foley

Garante, the Italian data protection authority, has published a decision in which it imposed a fine of 150,000 euros ($161,000) against phone provider Sigma srl for having illicitly activated SIM (subscriber identity module) cards, subscriptions and charges for the purchase of cellphones, and GPS trackers using the personal information of hundreds of users without their knowledge.

In its May 3 newsletter, Garante said the decision resulted from information provided by Italian law enforcement about an investigation into a compliant received in March 2022 from a customer who discovered charges on her credit card related to the activation of a new contract in the name of her deceased husband. Garante then conducted its own investigation and found numerous violations of the European Union’s General Data Protection Regulation (GDPR).

The decision found that Sigma had activated 1,300 SIM cards using data and identity documents extrapolated from the systems of the telecom carrier whose products it sold. Sigma also activated unsolicited services by inducing customers to sign forms, via a tablet, without clarifying the consequences of their consent. In addition, Sigma charged customers for mobile phones that had not been requested nor delivered to them, Garante said.

Garante found that Sigma engaged in activities aimed at systematically circumventing the principles of lawfulness, correctness, and transparency provided in the GDPR. In addition to imposing the fine, Garante banned Sigma from any further processing of personal data. In addition, Garante ordered the company to communicate to Garante the initiatives it would undertake to implement the required measures within 30 days of the company being notified of the decision.

News: LitigationEnforcement DataPrivacy GDPR