Spain's National High Court has upheld a fine of 200,000 euros the AEPD (the data protection agency) imposed on low-cost mobile operator ... Digi in 2024 for allowing the fraudulent duplication of a Sim card.
The court ruling states that "the card was issued inappropriately", which allowed a third party to "gain access to confidential information" stored on it. This negligence resulted in the cardholder being charged 800 euros for two transactions via Bizum, in addition to three other failed attempts of around 500 euros each.
Consumers' organisation Facua has pointed out that, when the account holder contacted Digi to find out who had authorised the charges, the company confirmed that a copy of her Sim card had been handed over a few days earlier to a person who had requested it at a customer service point.
"Under no circumstances was the identity of this third party verified, nor was it checked whether they were authorised to request a replacement," Facua said.
Thanks to the intervention of Facua, the customer managed to recover the 800 euros she had been defrauded of, but Facua's legal team also lodged a complaint with the AEPD. This body imposed a fine of 200,000 euros on the company for GDPR.
Digi lodged an appeal against the AEPD's decision, which the National High Court has now dismissed.
The hefty fine is due to the fact that this is apparently not the first time Digi has committed this offence. In fact, the AEPD has already had to intervene on three occasions for the same reason.
Consequently, instead of the 70,000 fine imposed on the company in previous cases, the data protection agency set a fine of 200,000 euros, considering "any previous infringement committed by the responsible party" to be an aggravating factor.